Unhandled Exception raised for non-admin access to /spend/logs instead of HTTP 403

[chipi]

Signal: Exception: Only proxy admin can be used to generate, delete, update info for new keys/users/teams. … (source: glitchtip, fp: glitchtip:LITELLM-D)

Symptom: The route /spend/logs raises a generic Exception when a non-admin user attempts to access it, resulting in a 500 error instead of a proper 403 Forbidden response.

Area: litellm proxy auth route checks

Acceptance criteria (intent-cited):

• Non-admin requests to admin‑only routes must be rejected with HTTP 403, not throw an unhandled Exception that results in a 500 error. (intent: code-invariant)

Evidence:

• Stack trace shows raise in _raise_admin_only_route_exception (route_checks.py:224) called from non_proxy_admin_allowed_routes_check (route_checks.py:325) for route /spend/logs.
• Exception message: 'Only proxy admin can be used to generate, delete, update info for new keys/users/teams.'
• Occurred 2 times in production, currently unresolved.

Filed by signal-fleet MVP.