feat(security): implement P0 critical security fixes for API, console, and access control

- Computes API: mark password as write_only in ComputeSerializer, restrict ComputeViewSet and architectures to IsAdminUser.
- Instances API: enforce user ownership tenant isolation in InstanceViewSet.list, restrict MigrateViewSet and CreateInstanceViewSet to IsAdminUser, require IsAdminUser for mutating FlavorViewSet.
- Storage, Network, and Interface APIs: restrict StorageViewSet, VolumeViewSet, NetworkViewSet, InterfaceViewSet to IsAdminUser.
- AppSettings & NWFilters: protect appsettings and nwfilter views with @superuser_only (403 Forbidden for non-superusers).
- noVNC Console: sign tokens with TimestampSigner (salt='console.novnc', max_age=600), verify signature and user authorization in novncd with backward-compatible fallback for debug/test mode.
- Accounts: avoid hardcoded default admin password; generate cryptographically secure random password unless ADMIN_PASSWORD is set (preserve 'admin' in test runner).
- gstfsd daemon: bind to 127.0.0.1 by default instead of 0.0.0.0.
- Tests: added comprehensive test coverage for API security, token expiration/rejection, and view permissions (132 tests passing).

interfaces/api/viewsets.py

@@ -1,19 +1,18 @@
 from django.shortcuts import get_object_or_404
 from computes.models import Compute
-from rest_framework import status, viewsets
-
-
+from rest_framework import permissions, status, viewsets
+from rest_framework.response import Response
 from vrtManager.interface import wvmInterfaces, wvmInterface
 
 from .serializers import InterfacesSerializer
-from rest_framework.response import Response
-
 
 
 class InterfaceViewSet(viewsets.ViewSet):
     """
     A viewset for listing retrieving interfaces.
     """
+
+    permission_classes = [permissions.IsAdminUser]
     
     def list(self, request, compute_pk=None):
         queryset = []