fix(security): protect admin credentials and plugin downloads

routes/admin.py

@@ -196,6 +196,11 @@ def admin_get_user_servers(user_id):
             return jsonify({'success': False, 'error': 'Admin access required'}), 403
 
         servers = get_user_servers(user_id)
+        # Admin server management does not need connection credentials.
+        servers = [
+            {key: value for key, value in server.items() if key != 'sftp_password'}
+            for server in servers
+        ]
         return jsonify({'success': True, 'servers': servers}), 200
 
     except Exception as e:
@@ -331,7 +336,7 @@ def admin_get_all_servers():
             cursor.execute('''
                 SELECT s.id, s.name, s.cpu, s.ram, s.storage, s.image, s.type, s.version, s.loader, s.java_version,
                        s.status, s.ports, s.created_at, u.username as owner, u.id as owner_id,
-                       s.sftp_username, s.sftp_password, s.sftp_port
+                       s.sftp_username, s.sftp_port
                 FROM servers s
                 JOIN users u ON s.owner_id = u.id
                 ORDER BY u.username, s.name