[Bug]: Security score banner and Security Overview page show false negatives to non-admin RBAC roles

[123dev]

Describe the bug

Pulse's "Security score" banner (shown at the top of pages until dismissed for 1 day/1 week/forever) and the corresponding Settings | Security Overview page report incorrect
"No"/critical status for settings-derived checks (Export requires authentication, Audit logging enabled, HTTPS, API token, Proxy auth) when viewed by a non-admin RBAC role , even when those features are correctly configured. Confirmed by comparing the same instance's reported state when viewed as local admin vs. a non-admin role.

To reproduce

1. Enable Pulse Pro / RBAC with a properly configured, secure instance (HTTPS, audit logging, export protection all enabled)
2. Log in as a non-admin RBAC role (tested with Viewer, and a custom role granted read:* plus explicit read:settings).
3. Observe the "Security score" banner and/or Settings | Security Overview.
4. Log in as local admin , the same instance now correctly reports these as enabled.

Expected behavior

Either the banner/page should reflect the instance's actual security posture regardless of viewer role, or it should indicate "insufficient permissions to view security status" rather than a false negative, for any role lacking full admin access.

Pulse version

v6.1.2

Agent version

v6.1.2

Image tag or digest

This field should be optional when LXC is selected

Installation type

ProxmoxVE LXC

Relevant logs or diagnostics

See the screenshots

Confirmations

• I verified the exact Pulse version and image reference from the running instance.
• I searched existing issues for duplicates.

[pulse-triage]

Both surfaces held up. The banner half was already fixed on main for #1650, it no longer scores a truncated status response. The Security Overview page had the same flaw and is fixed in 67cc1aa, non-admin roles now see an explanation that the posture view needs an admin session instead of false negatives. For the why, the status endpoint only returns the settings-derived posture fields to admin sessions, and a role with read settings scope intentionally does not qualify because those fields describe deployment configuration. Should be addressed by the next release, please retest and comment if it persists.

The image reference field on the bug form is also no longer required for non-container installs.

_{Posted by an automated triage run. rcourtman reviews everything it does. See the AI transparency statement.}