getAcademicDropdownData anonymous-callable, same roster-PII leak class as PLUTO-635

Found during PLUTO-635 diff review (2026-07-30): getAcademicDropdownData() in src/lib/admin-actions.ts (returns adjuntos/comisiones/jtps -- the same staff-roster PII class PLUTO-635 just closed) has ZERO identity check, same anonymous-POST-callable exposure as the lookup-actions.ts exports. Two current callers: (1) src/app/(protected)/admin/usuarios/nuevo/page.tsx -- under the protected-route layout.tsx chokepoint, already has a session by the time it reaches here; (2) src/app/solicitar-acceso/completar/page.tsx -- deliberately SESSIONLESS (HMAC resume-link verified via verifyResumeLink(rid, neededFields, exp, sig) before this call), per evolutiva-commons §Auth signed-link-completion exemption. Unlike PLUTO-635's tipoDocumento carve-out, this data IS the sensitive roster PII itself, so a blanket sessionless allowlist is wrong here -- the fix needs to authorize BOTH legitimate paths (protected-route session OR resume-link-verified context) while still rejecting a bare anonymous POST with neither. Open design question for you to resolve, not prescribing the mechanism: e.g. guard requireAuthForAction() by default and have completar/page.tsx pass its already-verified resume-link proof into a variant that checks it server-side, or another shape you find cleaner given the existing resume-link helpers. Same severity class pmmaster flagged as tonight's top finding -- treat as immediately following PLUTO-635, Class-A, same review path (no audit-pluto-ca available, PM reviews the diff directly).