fix(cabana): the backend middleware refuses a dispatch marker carrying a frontend principal

- cabana wraps the bouncer backend guard middleware: a marker that lists the
  backend guard with Backend false answers 401 before the guard honours it,
  as ResolveBackend already does, so a frontend user id is never read as an
  administrator's by the admin API or a backend-guarded plugin route
- found by plan 19.7-05's TestDispatchMarker (admin API in-process case)

modules/cabana/http.go

@@ -196,10 +196,11 @@ func Activate(app *backpack.App, plugins []party.Plugin) (*Routes, error) {
 			return nil, fmt.Errorf("cabana: backend resolver: %w", err)
 		}
 	}
-	mw, err := guards.Middleware("backend")
+	guardMW, err := guards.Middleware("backend")
 	if err != nil {
 		return nil, err
 	}
+	mw := refuseFrontendMarker(guardMW)
 	loginMax, loginDecay := adminLoginWindow(app)
 	svc := &service{
 		app:        app,
@@ -243,6 +244,24 @@ func (s *service) serveSPA(w http.ResponseWriter, r *http.Request) {
 	s.spa.ServeHTTP(w, r)
 }
 
+// refuseFrontendMarker wraps the backend guard middleware: an in-process
+// dispatch marker that lists the "backend" guard but carries a frontend
+// principal (Backend false) is answered 401 before the guard honours it, as
+// ResolveBackend refuses it, so no frontend user id is ever read as an
+// administrator's by the admin API or a backend-guarded plugin route.
+func refuseFrontendMarker(next pact.Middleware) pact.Middleware {
+	return func(h http.Handler) http.Handler {
+		inner := next(h)
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if d, ok := bouncer.Dispatched(r.Context(), "backend"); ok && !d.Principal.Backend {
+				writeUnauthenticated(w, ErrUnauthenticated)
+				return
+			}
+			inner.ServeHTTP(w, r)
+		})
+	}
+}
+
 func writeUnauthenticated(w http.ResponseWriter, _ error) {
 	WriteError(w, http.StatusUnauthorized, "unauthenticated", msgUnauthenticated)
 }