Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@hub_adapter/auth.py`:
- Around line 270-288: The RBAC check currently returns verified_token when
role_claim_name is set but admin_role is empty, allowing unintended access;
update the check in the block that handles role_claim_name/parsed_claim (the
code that reads role_claim_name, admin_role and returns verified_token) to fail
closed by raising an HTTPException when role_claim_name is truthy but admin_role
is falsy (e.g., raise HTTPException(status_code=500 or 400 with a clear message
about misconfiguration and service "Auth")). Place this validation before
parsing the claim keys so any partial RBAC config triggers an error instead of
bypassing admin role enforcement.

In `@hub_adapter/routers/logs.py`:
- Around line 389-439: The handler currently applies the incoming limit to the
raw _execute_raw_query call so only up to limit raw log rows are fetched before
aggregating into totals (logsql_query/params), which truncates
bytes_in/bytes_out when an analysis produces more rows; change the logic to page
through all raw rows before summing: use count_logs(base_query, params) to get
total, then loop calls to _execute_raw_query with offset/limit (or repeatedly
advance a start/offset parameter) until you've fetched total rows, accumulate
into totals (the totals dict / NetStatRun population) and only then compute meta
and return — alternatively, if you prefer pagination, remove limit from the raw
query and instead paginate the final grouped list (totals) after aggregation;
update usage around logsql_query, params, _execute_raw_query, count_logs, and
totals to implement one of these fixes.
- Around line 216-217: The async endpoint handlers (get_events,
get_analysis_logs, get_analysis_log_history, get_netstats, raw_log_query,
get_api_requests) are calling synchronous helpers (count_logs, query_logs,
_query_pod_logs, _get_analysis_container_names, _execute_raw_query) that use
httpx.Client and block the event loop; convert those helpers to async functions
that use httpx.AsyncClient and await the network calls, then update callers to
await the new async helpers (or alternatively make the handlers normal def so
FastAPI runs them in the threadpool). Specifically: change count_logs,
query_logs, _query_pod_logs, _get_analysis_container_names, _execute_raw_query
to async, replace httpx.Client() with httpx.AsyncClient() and await
.get/post/.stream as appropriate, update all handler calls (e.g., inside
get_events, get_analysis_logs, get_analysis_log_history, get_netstats,
raw_log_query, get_api_requests) to await the helpers, and ensure
require_victoria_logs compatibility and tests pass.