revert: leave the global concurrency-group listing on the plain admin gate

The listing exposes concurrency keys across workspaces, which is metadata
rather than a capability, and it 401s rather than degrading. Keep the guard
on the prune route next to it, which is the destructive one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/tests/wm_token_superadmin_guard.rs

@@ -467,22 +467,7 @@ async fn test_wm_token_rejected_by_instance_admin_gates(db: Pool<Postgres>) -> a
         resp.text().await?
     );
 
-    // 3. The sibling listing spans every workspace's concurrency keys, so it is
-    //    gated the same way as the prune above.
-    let resp = authed(
-        client().get(format!("{base}/concurrency_groups/list")),
-        &sa_wm,
-    )
-    .send()
-    .await?;
-    assert_eq!(
-        resp.status(),
-        401,
-        "superadmin WM_TOKEN must not list global concurrency groups: {}",
-        resp.text().await?
-    );
-
-    // 4. Worker-group config: the static env value must be masked for a job token.
+    // 3. Worker-group config: the static env value must be masked for a job token.
     let body = authed(
         client().get(format!("{base}/configs/list_worker_groups")),
         &sa_wm,

backend/windmill-api-jobs/src/concurrency_groups.rs

@@ -1,8 +1,9 @@
-use windmill_api_auth::{check_scopes, is_instance_admin, require_instance_admin, ApiAuthed};
+use windmill_api_auth::{check_scopes, is_instance_admin, ApiAuthed};
 use windmill_common::{
     db::{UserDB, DB},
     error::Error::PermissionDenied,
     error::{self, JsonResult},
+    utils::require_admin,
 };
 
 use crate::query::{filter_list_completed_query, filter_list_queue_query};
@@ -42,9 +43,7 @@ async fn list_concurrency_groups(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
 ) -> JsonResult<Vec<ConcurrencyGroups>> {
-    // Instance-global: the listing spans every workspace's concurrency keys, so a job
-    // token's workspace-admin claim must not reach it (mirrors the prune route below).
-    require_instance_admin(&authed)?;
+    require_admin(authed.is_admin, &authed.username)?;
 
     let concurrency_counts = sqlx::query_as::<_, (String, i64)>(
         "SELECT concurrency_id, (select COUNT(*) from jsonb_object_keys(job_uuids)) as n_job_uuids FROM concurrency_counter",