fix(energy): checkpoint validated drill pagination and read-only preview

Co-authored-by: HiFox Agent <agents-noreply@hifox.com>

src/server/app.ts

@@ -1,5 +1,6 @@
 import { serveStatic } from '@hono/node-server/serve-static';
 import { Hono } from 'hono';
+import { readOnlyMiddleware } from './read-only-middleware.js';
 import { cors } from 'hono/cors';
 import authRouter from './auth/login.js';
 import { authMiddleware } from './auth/middleware.js';
@@ -20,6 +21,7 @@ export function createApp(): Hono {
   const app = new Hono();
 
   app.use('/api/*', cors());
+  app.use('/api/*', readOnlyMiddleware);
 
   // 登录接口公开，其余 API 统一经过认证与数据权限检查。
   app.route('/api/auth', authRouter);