fix(api): restrict admin metrics to admin role

[es3298]

/claim #743
/claim #10905

Fixes #10905

Summary

• Adds adminMiddleware to require req.user.role === admin after JWT authentication.
• Applies the admin role guard to /api/admin routes.
• Adds route coverage for unauthenticated requests, authenticated non-admin requests, and admin access.

Why

/api/admin/metrics previously accepted any valid JWT, so non-admin users could read admin metrics. The route now preserves 401 for missing/invalid tokens and returns 403 for authenticated non-admin users.

Demo

https://raw.githubusercontent.com/es3298/bug-bounty/es3298/admin-role-claim-refresh/docs/demo/admin-role-hardening-10905.mp4

Validation

• node --test apps/api/src/tests/adminRoutes.test.js
• npm test --workspace apps/api
• git diff --check origin/main...HEAD

Claim notes

This is a refreshed es3298 submission for the creator-owned scoped issue #10905 under parent bounty #743. The previous PR #10906 had the same focused fix but did not receive the update-leaderboard opened-event workflow, so this PR is opened from current origin/main to enter the normal claim automation path. No payout, credential, wallet, or off-platform payment details are included publicly.

[es3298]

@claim-reviewer this refreshed es3298 PR is open, mergeable, and the update-leaderboard workflow passed on the opened PR. It closes creator-owned issue #10905 under parent bounty #743 with focused admin-route coverage and a demo video. If accepted for reward, please confirm whether payout is automatic or where @es3298 should provide payout details privately.