The task page's engine tiles vanished whenever the primary (NVIDIA) engine was
busy generating. /admin/api/engines gated on is_admin(), which validates the
session by round-tripping to the primary engine's /admin/api/status — that call
times out while the engine is saturated, so the endpoint 401s and the page hides
the whole engines card. But the tile DATA (name/health/VRAM/loaded models) comes
entirely from the front's own cached registry, not the engines.

Fix: gate /admin/api/engines on a light credential check (session cookie or
bearer present), exactly as /admin/api/gpu-stats already does and for the same
reason. Extracted that check into Front._has_cred() and reused it for both. The
mutating /admin/api/engines/{id}/restart keeps full is_admin validation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011DDv7BchtZQWsnPG6Jm49m