feat: add member portal and auth hardening

src/integration/api-gateway/middleware/admin-central-auth.middleware.ts

@@ -12,17 +12,19 @@ export function requireAdminCentralKey(req: Request, res: Response, next: NextFu
 
   if (!expected) {
     // If not configured, allow (dev) or deny (prod). Prefer deny for security.
-    return res.status(501).json({
+    res.status(501).json({
       success: false,
       error: { code: 'NOT_CONFIGURED', message: 'Admin central API key not configured' },
     });
+    return;
   }
 
   if (!key || key !== expected) {
-    return res.status(401).json({
+    res.status(401).json({
       success: false,
       error: { code: 'UNAUTHORIZED', message: 'Invalid or missing X-Admin-Central-Key' },
     });
+    return;
   }
 
   next();