Architecture documentation describes aggregate_readings as admin-only, but the contract performs no admin authentication for that method.
Acceptance criteria:
- Choose and document the intended caller model.
- Update code or documentation so they agree.
- Add an authorization test if aggregation becomes restricted.
Architecture documentation describes aggregate_readings as admin-only, but the contract performs no admin authentication for that method.
Acceptance criteria: