fix: operators cannot archive or delete flows and apps (#10322)

`create_flow`/`update_flow` and `create_app`/`update_app` reject operators, but
`archive_flow_by_path`, `delete_flow_by_path` and `delete_app` did not — so an
operator with folder write could delete a flow or app they were not allowed to
edit. Scripts already get this right (archive is guarded, delete is admin-only).

Verified on a live instance: all three returned 2xx for an operator before, 401
after, and a non-operator member with the same folder write is unaffected.

backend/windmill-api-flows/src/flows.rs

@@ -1622,6 +1622,11 @@ async fn archive_flow_by_path(
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(archived): Json<Archived>,
 ) -> Result<String> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot archive flows for security reasons".to_string(),
+        ));
+    }
     let path = path.to_path();
     check_scopes(&authed, || format!("flows:write:{}", path))?;
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
@@ -1762,6 +1767,11 @@ async fn delete_flow_by_path(
     Path((w_id, path)): Path<(String, StripPath)>,
     Query(query): Query<DeleteFlowQuery>,
 ) -> Result<String> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot delete flows for security reasons".to_string(),
+        ));
+    }
     let path = path.to_path();
     check_scopes(&authed, || format!("flows:write:{}", path))?;
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(

backend/windmill-api/src/apps.rs

@@ -2121,6 +2121,11 @@ async fn delete_app(
     Extension(webhook): Extension<WebhookShared>,
     Path((w_id, path)): Path<(String, StripPath)>,
 ) -> Result<String> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot delete apps for security reasons".to_string(),
+        ));
+    }
     let path = path.to_path();
     check_scopes(&authed, || format!("apps:write:{}", path))?;