security: restrict cluster/pool selection to admin users only

Backend:
- ApplicationsService.create() now accepts userRole parameter
- Non-admin users have clusterId/poolId stripped automatically
- Logs warning when non-admin attempts manual cluster selection

Frontend:
- Deploy wizard hides cluster assignment mode selector for non-admin users
- Non-admin users see a simple 'Default Cluster' info box instead
- Cluster/pool API queries only execute for admin users (enabled: isAdmin)
- Review step shows 'Default Cluster' for non-admin regardless of form state

backend/src/applications/applications.controller.ts

@@ -42,7 +42,7 @@ export class ApplicationsController {
   @Post()
   @ApiOperation({ summary: 'Create a new application' })
   async create(@Request() req: any, @Body() dto: CreateApplicationDto) {
-    return this.applicationsService.create(req.user.id, dto);
+    return this.applicationsService.create(req.user.id, dto, req.user.role);
   }
 
   @Post(':id/upload')

backend/src/applications/applications.service.ts

@@ -7,6 +7,7 @@ import * as path from 'path';
 import { Application } from './entities/application.entity';
 import { CreateApplicationDto, UpdateApplicationDto } from './dto/application.dto';
 import { ClustersService } from '../clusters/clusters.service';
+import { UserRole } from '../common/enums';
 
 @Injectable()
 export class ApplicationsService {
@@ -19,7 +20,17 @@ export class ApplicationsService {
     private configService: ConfigService,
   ) {}
 
-  async create(userId: string, dto: CreateApplicationDto): Promise<Application> {
+  async create(userId: string, dto: CreateApplicationDto, userRole?: string): Promise<Application> {
+    // Only admin users can manually select cluster or pool
+    // Regular users always get the default cluster assignment
+    if (userRole !== UserRole.ADMIN) {
+      if (dto.clusterId || dto.poolId) {
+        this.logger.warn(`Non-admin user ${userId} attempted manual cluster/pool selection — ignoring`);
+      }
+      dto.clusterId = undefined;
+      dto.poolId = undefined;
+    }
+
     // Cluster assignment: 3 modes
     // 1. Manual: specific clusterId provided
     // 2. Pool-based LB: poolId provided → pick from pool using pool's strategy

frontend/src/app/dashboard/deploy/page.tsx

@@ -4,6 +4,7 @@ import { useState, useRef, useCallback } from 'react';
 import { useRouter } from 'next/navigation';
 import { useMutation, useQuery } from '@tanstack/react-query';
 import api from '@/lib/api';
+import { useAuthStore } from '@/lib/store';
 import toast from 'react-hot-toast';
 import type { CreateApplicationDto, ClusterPublic, ClusterPoolPublic } from '@/types';
 
@@ -11,6 +12,8 @@ const steps = ['Basic Info', 'Runtime & Database', 'Resources', 'Review'];
 
 export default function DeployPage() {
   const router = useRouter();
+  const user = useAuthStore((s) => s.user);
+  const isAdmin = user?.role === 'admin';
   const [step, setStep] = useState(0);
   const [form, setForm] = useState<CreateApplicationDto>({
     name: '',
@@ -40,11 +43,13 @@ export default function DeployPage() {
   const { data: clusters = [] } = useQuery<ClusterPublic[]>({
     queryKey: ['clusters-public'],
     queryFn: () => api.get('/clusters/public').then((r) => r.data),
+    enabled: isAdmin,
   });
 
   const { data: pools = [] } = useQuery<ClusterPoolPublic[]>({
     queryKey: ['pools-public'],
     queryFn: () => api.get('/clusters/pools/public').then((r) => r.data),
+    enabled: isAdmin,
   });
 
   const createMutation = useMutation({
@@ -391,7 +396,8 @@ export default function DeployPage() {
           <div className="space-y-6">
             <h2 className="text-lg font-semibold text-gray-900">Resources & Configuration</h2>
 
-            {/* Cluster Assignment Mode */}
+            {/* Cluster Assignment Mode — Admin only */}
+            {isAdmin ? (
             <div>
               <label className="block text-sm font-medium text-gray-700 mb-2">Cluster Assignment</label>
               <div className="grid grid-cols-1 sm:grid-cols-3 gap-3 mb-4">
@@ -553,6 +559,19 @@ export default function DeployPage() {
                 </div>
               )}
             </div>
+            ) : (
+            <div className="p-3 bg-gray-50 rounded-xl border border-gray-200">
+              <div className="flex items-center space-x-3">
+                <span className="text-lg">🏠</span>
+                <div>
+                  <p className="text-sm font-medium text-gray-700">Cluster Assignment</p>
+                  <p className="text-xs text-gray-500">
+                    Your app will be automatically deployed to the platform&apos;s default cluster
+                  </p>
+                </div>
+              </div>
+            </div>
+            )}
 
             <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
               <div>
@@ -687,9 +706,9 @@ export default function DeployPage() {
               <div className="flex justify-between">
                 <span className="text-sm text-gray-500">Cluster</span>
                 <span className="text-sm font-medium">
-                  {clusterMode === 'manual' && form.clusterId
+                  {isAdmin && clusterMode === 'manual' && form.clusterId
                     ? `🎯 ${clusters.find((c) => c.id === form.clusterId)?.name || form.clusterId}`
-                    : clusterMode === 'pool' && form.poolId
+                    : isAdmin && clusterMode === 'pool' && form.poolId
                     ? `⚖️ ${pools.find((p) => p.id === form.poolId)?.name || 'Pool'} (Load Balanced)`
                     : '🏠 Default Cluster'}
                 </span>