security: restrict cluster/pool selection to admin users only

Backend:
- ApplicationsService.create() now accepts userRole parameter
- Non-admin users have clusterId/poolId stripped automatically
- Logs warning when non-admin attempts manual cluster selection

Frontend:
- Deploy wizard hides cluster assignment mode selector for non-admin users
- Non-admin users see a simple 'Default Cluster' info box instead
- Cluster/pool API queries only execute for admin users (enabled: isAdmin)
- Review step shows 'Default Cluster' for non-admin regardless of form state

frontend/src/app/dashboard/deploy/page.tsx

@@ -4,6 +4,7 @@ import { useState, useRef, useCallback } from 'react';
 import { useRouter } from 'next/navigation';
 import { useMutation, useQuery } from '@tanstack/react-query';
 import api from '@/lib/api';
+import { useAuthStore } from '@/lib/store';
 import toast from 'react-hot-toast';
 import type { CreateApplicationDto, ClusterPublic, ClusterPoolPublic } from '@/types';
 
@@ -11,6 +12,8 @@ const steps = ['Basic Info', 'Runtime & Database', 'Resources', 'Review'];
 
 export default function DeployPage() {
   const router = useRouter();
+  const user = useAuthStore((s) => s.user);
+  const isAdmin = user?.role === 'admin';
   const [step, setStep] = useState(0);
   const [form, setForm] = useState<CreateApplicationDto>({
     name: '',
@@ -40,11 +43,13 @@ export default function DeployPage() {
   const { data: clusters = [] } = useQuery<ClusterPublic[]>({
     queryKey: ['clusters-public'],
     queryFn: () => api.get('/clusters/public').then((r) => r.data),
+    enabled: isAdmin,
   });
 
   const { data: pools = [] } = useQuery<ClusterPoolPublic[]>({
     queryKey: ['pools-public'],
     queryFn: () => api.get('/clusters/pools/public').then((r) => r.data),
+    enabled: isAdmin,
   });
 
   const createMutation = useMutation({
@@ -391,7 +396,8 @@ export default function DeployPage() {
           <div className="space-y-6">
             <h2 className="text-lg font-semibold text-gray-900">Resources & Configuration</h2>
 
-            {/* Cluster Assignment Mode */}
+            {/* Cluster Assignment Mode — Admin only */}
+            {isAdmin ? (
             <div>
               <label className="block text-sm font-medium text-gray-700 mb-2">Cluster Assignment</label>
               <div className="grid grid-cols-1 sm:grid-cols-3 gap-3 mb-4">
@@ -553,6 +559,19 @@ export default function DeployPage() {
                 </div>
               )}
             </div>
+            ) : (
+            <div className="p-3 bg-gray-50 rounded-xl border border-gray-200">
+              <div className="flex items-center space-x-3">
+                <span className="text-lg">🏠</span>
+                <div>
+                  <p className="text-sm font-medium text-gray-700">Cluster Assignment</p>
+                  <p className="text-xs text-gray-500">
+                    Your app will be automatically deployed to the platform&apos;s default cluster
+                  </p>
+                </div>
+              </div>
+            </div>
+            )}
 
             <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
               <div>
@@ -687,9 +706,9 @@ export default function DeployPage() {
               <div className="flex justify-between">
                 <span className="text-sm text-gray-500">Cluster</span>
                 <span className="text-sm font-medium">
-                  {clusterMode === 'manual' && form.clusterId
+                  {isAdmin && clusterMode === 'manual' && form.clusterId
                     ? `🎯 ${clusters.find((c) => c.id === form.clusterId)?.name || form.clusterId}`
-                    : clusterMode === 'pool' && form.poolId
+                    : isAdmin && clusterMode === 'pool' && form.poolId
                     ? `⚖️ ${pools.find((p) => p.id === form.poolId)?.name || 'Pool'} (Load Balanced)`
                     : '🏠 Default Cluster'}
                 </span>