test(proxy): cover auth_v2 policy-admin gate (_require_admin) - privilege escalation guard

The policy CRUD endpoints were gated by _require_admin but it had no test. Add
deny/allow coverage: only PROXY_ADMIN may edit policies; view-only admins, every
other role, and no role are rejected with 403. This is the guard that stops a
non-admin from editing the casbin policy store, so a silent regression here would
be a privilege escalation.

tests/test_litellm/proxy/auth/v2/test_management_endpoints.py

@@ -1,4 +1,34 @@
-from litellm.proxy.auth.v2.management_endpoints import rule_to_row_data, row_to_rule
+from types import SimpleNamespace
+
+import pytest
+from fastapi import HTTPException
+
+from litellm.proxy._types import LitellmUserRoles
+from litellm.proxy.auth.v2.management_endpoints import (
+    _require_admin,
+    row_to_rule,
+    rule_to_row_data,
+)
+
+
+def test_require_admin_allows_only_proxy_admin():
+    # No raise for a full proxy admin.
+    _require_admin(SimpleNamespace(user_role=LitellmUserRoles.PROXY_ADMIN))
+
+
+def test_require_admin_blocks_non_admins():
+    # Privilege-escalation guard: only PROXY_ADMIN may edit policies. View-only
+    # admins and every other role (and no role) must be rejected with 403.
+    for role in (
+        LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY,
+        LitellmUserRoles.INTERNAL_USER,
+        LitellmUserRoles.INTERNAL_USER_VIEW_ONLY,
+        LitellmUserRoles.TEAM,
+        None,
+    ):
+        with pytest.raises(HTTPException) as exc:
+            _require_admin(SimpleNamespace(user_role=role))
+        assert exc.value.status_code == 403
 
 
 class _Row: