fix: address packet auth static analysis

Make the routing authentication gate input const and collapse licensed Admin authorization into a single branch so legacy response, local, channel, and PKI checks run only for non-licensed-remote traffic.

Author: RCGV1

src/mesh/FloodingRouter.cpp

@@ -71,7 +71,7 @@ bool FloodingRouter::perhapsHandleUpgradedPacket(const meshtastic_MeshPacket *p)
         // Verify the replacement before deleting the valid lower-hop copy waiting in the TX queue.
         // This is intentionally redundant with ReliableRouter's ingress gate: it keeps this helper
         // safe if another caller is introduced later.
-        if (passesRoutingAuthGate(const_cast<meshtastic_MeshPacket *>(p)) != RoutingAuthVerdict::ACCEPT)
+        if (passesRoutingAuthGate(p) != RoutingAuthVerdict::ACCEPT)
             return true;
 
         // If we overhear a duplicate copy of the packet with more hops left than the one we are waiting to

src/mesh/Router.cpp

@@ -688,7 +688,7 @@ bool checkXeddsaReceivePolicy(meshtastic_MeshPacket *p)
 }
 #endif
 
-RoutingAuthVerdict passesRoutingAuthGate(meshtastic_MeshPacket *p)
+RoutingAuthVerdict passesRoutingAuthGate(const meshtastic_MeshPacket *p)
 {
     // Routing still needs the original encrypted representation for byte-for-byte relay and for
     // MQTT uplink. Authenticate a copy here; handleReceived() performs the normal in-place decode

src/mesh/Router.h

@@ -175,7 +175,7 @@ enum class RoutingAuthVerdict { ACCEPT, OPAQUE_RELAY_ONLY, REJECT };
 DecodeState perhapsDecode(meshtastic_MeshPacket *p);
 
 /** Apply receive authentication before routing state mutation; unknown-channel packets may remain opaque relay-only. */
-RoutingAuthVerdict passesRoutingAuthGate(meshtastic_MeshPacket *p);
+RoutingAuthVerdict passesRoutingAuthGate(const meshtastic_MeshPacket *p);
 #ifdef PIO_UNIT_TESTING
 uint32_t routingAuthEvaluationCount();
 void resetRoutingAuthEvaluationCount();

src/modules/AdminModule.cpp

@@ -146,6 +146,7 @@ bool AdminModule::handleReceivedProtobuf(const meshtastic_MeshPacket &mp, meshta
     meshtastic_Channel *ch = &channels.getByIndex(mp.channel);
     const bool licensedRemote = owner.is_licensed && mp.from != 0;
     bool authorizedLicensedSigner = false;
+    // Could tighten responses further by tracking the last public key queried.
     if (licensedRemote) {
         const bool directedAdmin = mp.to == nodeDB->getNodeNum() && !isBroadcast(mp.to) &&
                                    mp.decoded.portnum == meshtastic_PortNum_ADMIN_APP && !mp.pki_encrypted;
@@ -165,7 +166,7 @@ bool AdminModule::handleReceivedProtobuf(const meshtastic_MeshPacket &mp, meshta
             myReply = allocErrorResponse(meshtastic_Routing_Error_ADMIN_PUBLIC_KEY_UNAUTHORIZED, &mp);
             return handled;
         }
-        LOG_INFO("Signed licensed admin payload with authorized Router-verified sender");
+        LOG_INFO("Signed licensed admin payload with Router-verified sender");
     }
     if (messageIsResponse(r)) {
         // Only accept a response from a remote we sent the matching request to. from == 0 is a