ImprovementApril 16, 2026

security: enforce authentication and membership on API endpoints

Services, ServiceCategories, ServiceInquiries: all read endpoints changed from AllowAny to IsAuthenticated + community membership verification. Non-members can no longer view services from communities they don't belong to.
CommunityMembersView, CommunityLeadersView: changed from AllowAny to IsAuthenticated + membership check. Staff/superusers bypass.
DirectoryMemberViewSet: changed from AllowAny to IsAuthenticated. Removed the public directory bypass that allowed anonymous access.