Platform-wide routes require the operator account

Telemetry, monitoring and the diagnostic endpoints were reachable with a permission that every role holds, which exposed server metrics to any tenant.