Fix: protect api/powerlimiter/status endpoint

this endpoint must not spill info if read-only access is disabled.

src/WebApi_powerlimiter.cpp

@@ -27,6 +27,10 @@ void WebApiPowerLimiterClass::init(AsyncWebServer& server, Scheduler& scheduler)
 
 void WebApiPowerLimiterClass::onStatus(AsyncWebServerRequest* request)
 {
+    if (!WebApi.checkCredentialsReadonly(request)) {
+        return;
+    }
+
     AsyncJsonResponse* response = new AsyncJsonResponse();
     auto& root = response->getRoot();
     auto const& config = Configuration.get();