Enforce role-based authorization on admin-only routes (#10)

isLoggedIn only verified a valid JWT, so an authenticated editor could
call any admin endpoint (create/promote/delete users, flip site mode,
change settings). Add a requireRole middleware factory and gate the
sensitive routes with admin-only:

- PUT  /site-mode
- GET/PUT /settings
- all /users/* (list/create/update/delete)

Content routes (posts, wiki, categories, tags, uploads, dashboard,
activity) remain available to editors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/router/v1/admin/admin.routes.js

@@ -5,7 +5,7 @@ const multer = require('multer')
 const { body, param } = require('express-validator')
 
 const ctrl = require('./admin.controller')
-const { isLoggedIn } = require('../../../utils/auth')
+const { isLoggedIn, requireRole } = require('../../../utils/auth')
 const noindex = require('../../../middleware/noindex')
 const validate = require('../../../middleware/validate')
 
@@ -14,6 +14,10 @@ const adminRouter = express.Router()
 // Every admin route requires auth and is kept out of search indexes.
 adminRouter.use(noindex, isLoggedIn)
 
+// Admin-only gate. Editors may manage content (posts/wiki), but user
+// management, site mode, and settings are restricted to the admin role.
+const adminOnly = requireRole('admin')
+
 // ── Image uploads (screenshots/gallery) ───────────────────────────────
 const UPLOAD_DIR =
   process.env.UPLOAD_DIR || path.join(__dirname, '..', '..', '..', '..', 'uploads')
@@ -39,6 +43,7 @@ const upload = multer({
 adminRouter.get('/dashboard', ctrl.dashboard)
 adminRouter.put(
   '/site-mode',
+  adminOnly,
   body('mode').isIn(['live', 'maintenance']),
   validate,
   ctrl.setSiteMode,
@@ -135,13 +140,14 @@ adminRouter.post(
 adminRouter.delete('/wiki/:slug', ctrl.deleteWiki)
 
 // ── Settings ──────────────────────────────────────────────────────────
-adminRouter.get('/settings', ctrl.getSettings)
-adminRouter.put('/settings', ctrl.updateSettings)
+adminRouter.get('/settings', adminOnly, ctrl.getSettings)
+adminRouter.put('/settings', adminOnly, ctrl.updateSettings)
 
 // ── Activity log ──────────────────────────────────────────────────────
 adminRouter.get('/activity', ctrl.listActivity)
 
-// ── User management ───────────────────────────────────────────────────
+// ── User management (admin only) ──────────────────────────────────────
+adminRouter.use('/users', adminOnly)
 adminRouter.get('/users', ctrl.listUsers)
 adminRouter.post(
   '/users',