Alternate proxy path leaves the admin surface reachable even though the canonical route is protected

Security scans still reach an admin path because a second proxy route exposes the same upstream without the expected controls.