Restrict model sync to admin users only

Co-authored-by: lstein <111189+lstein@users.noreply.github.com>

Author: Copilot

invokeai/app/api/routers/model_manager.py

@@ -1212,7 +1212,7 @@ class DeleteOrphanedModelsResponse(BaseModel):
     operation_id="get_orphaned_models",
     response_model=list[OrphanedModelInfo],
 )
-async def get_orphaned_models() -> list[OrphanedModelInfo]:
+async def get_orphaned_models(_: AdminUserOrDefault) -> list[OrphanedModelInfo]:
     """Find orphaned model directories.
 
     Orphaned models are directories in the models folder that contain model files
@@ -1239,7 +1239,9 @@ async def get_orphaned_models() -> list[OrphanedModelInfo]:
     operation_id="delete_orphaned_models",
     response_model=DeleteOrphanedModelsResponse,
 )
-async def delete_orphaned_models(request: DeleteOrphanedModelsRequest) -> DeleteOrphanedModelsResponse:
+async def delete_orphaned_models(
+    request: DeleteOrphanedModelsRequest, _: AdminUserOrDefault
+) -> DeleteOrphanedModelsResponse:
     """Delete specified orphaned model directories.
 
     Args:

invokeai/frontend/web/src/features/modelManagerV2/subpanels/ModelManager.tsx

@@ -37,7 +37,7 @@ export const ModelManager = memo(() => {
           {t('common.modelManager')}
         </Heading>
         <Flex gap={2}>
-          <SyncModelsButton />
+          {canManageModels && <SyncModelsButton />}
           {!!selectedModelKey && canManageModels && (
             <Button size="sm" colorScheme="invokeYellow" leftIcon={<PiPlusBold />} onClick={handleClickAddModel}>
               {t('modelManager.addModels')}