Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint
GET /api/allusers is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata.