feat: restrict patient deletion to admin users only

apps/Backend/src/routes/patients.ts

@@ -322,19 +322,19 @@ router.delete(
 
       const patientId = parseInt(patientIdParam);
 
-      // Check if patient exists and belongs to user
+      // Only admin users can delete patients
+      if (req.user!.username !== "admin") {
+        return res.status(403).json({
+          message: "Forbidden: Only admin users can delete patients.",
+        });
+      }
+
+      // Check if patient exists
       const existingPatient = await storage.getPatient(patientId);
       if (!existingPatient) {
         return res.status(404).json({ message: "Patient not found" });
       }
 
-      if (existingPatient.userId !== req.user!.id) {
-        return res.status(403).json({
-          message:
-            "Forbidden: Patient belongs to a different user, you can't delete this.",
-        });
-      }
-
       // Delete patient
       await storage.deletePatient(patientId);
       res.status(204).send();