fix: address three gaps in Task 8 spec compliance

- get_rag_operational_stats() now returns at_risk_count,
  pinned_count, avg_retrieval_count via scroll-based computation
- GET /api/rag/stats requires admin role (was guest-accessible)
- test_rag_stats_endpoint asserts full shape per spec
- Add test_rag_stats_requires_admin (guest → 403)

routers/rag_admin.py

@@ -2,7 +2,7 @@
 import logging
 
 import httpx
-from fastapi import APIRouter, Request
+from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import JSONResponse
 
 from eviction import get_rag_operational_stats, EVICTION_LOG
@@ -13,7 +13,9 @@ router = APIRouter()
 
 
 @router.get("/api/rag/stats")
-async def rag_stats():
+async def rag_stats(request: Request):
+    if getattr(request.state, "session_role", "none") != "admin":
+        raise HTTPException(status_code=403, detail="Admin PIN required for this action")
     stats = await get_rag_operational_stats()
     stats["eviction_log_size"] = len(EVICTION_LOG)
     return stats