Pest: require district selection + restore B2B auth gate

api.py

@@ -875,9 +875,17 @@ def pest_risk(req: PestRiskRequest, user: _Opt[str] = Depends(_get_current_user)
     import datetime
     t0 = time.perf_counter()
 
-    # State-only pest queries are allowed for the farmer-facing portal.
-    # B2B value comes from comparative dashboards + alerts + APIs, not from
-    # gating single state lookups.
+    # ── B2B aggregate guard ────────────────────────────────────────────────────
+    # State-only queries (no district) return state-wide aggregates — those are
+    # the high-value bulk views B2B clients pay for. Require auth. Single-block
+    # queries (with district) stay open for retail / consumer demo use.
+    if not req.district and user is None:
+        raise HTTPException(
+            status_code=401,
+            detail="State-only pest aggregates require B2B authentication. "
+                   "POST /auth/token to get a token, or supply 'district' for "
+                   "a single-block lookup.",
+        )
 
     month = req.month or datetime.datetime.now().month
     year  = req.year  or datetime.datetime.now().year