Enforce role-based authorization on admin-only routes (#10)

isLoggedIn only verified a valid JWT, so an authenticated editor could
call any admin endpoint (create/promote/delete users, flip site mode,
change settings). Add a requireRole middleware factory and gate the
sensitive routes with admin-only:

- PUT  /site-mode
- GET/PUT /settings
- all /users/* (list/create/update/delete)

Content routes (posts, wiki, categories, tags, uploads, dashboard,
activity) remain available to editors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/utils/auth.js

@@ -85,6 +85,16 @@ function isLoggedIn(req, res, next) {
   return next()
 }
 
+// Gate middleware factory: allow only the listed roles. Assumes isLoggedIn ran
+// first so req.user is populated. Use for admin-only endpoints (users, site
+// mode, settings) so a lower-privilege editor cannot reach them.
+function requireRole(...roles) {
+  return (req, res, next) => {
+    if (roles.includes(req.user?.role)) return next()
+    return res.status(403).json({ message: 'Forbidden' })
+  }
+}
+
 module.exports = {
   COOKIE_NAME,
   signToken,
@@ -93,4 +103,5 @@ module.exports = {
   clearAuthCookie,
   getUserFromRequest,
   isLoggedIn,
+  requireRole,
 }