The POST /api/settings/test_object_storage_config endpoint was accessible to any authenticated user without requiring super admin privileges. This allowed SSRF by connecting to a user-specified S3 endpoint URL. Add the same require_super_admin check used by all other settings endpoints. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>