admin hardening

[Jumongweb]

Closes #115

🔖 Title

Harden admin audit-log access with server-side authorization

📝 Description

This PR closes a critical authorization gap on the /admin controller tree. It adds a server-side AdminGuard that checks the latest users row from Supabase on every request, so access decisions no longer rely only on JWT claims.

🔄 Changes Made

• Added src/modules/admin/admin.guard.ts to fetch role and status fresh from Supabase and deny by default unless the user is an active admin.
• Applied the new guard to GET /admin/audit-logs and documented the 401/403 responses in Swagger.
• Extended the users.role constraint to allow a real admin value in the database and updated the user profile DTO accordingly.
• Logged denied admin attempts with the same structured audit payload format used by the audit interceptor.
• Added unit tests for admin allow, non-admin deny, blocked admin deny, unauthenticated deny, stale-token deny, and Supabase lookup failure.

🗒️ Additional Notes

The guard intentionally trusts the database over the JWT role claim so role grants and revocations take effect immediately on the next request, even before token refresh.