test(admin): extract AdminGate, pin safety properties via regression test

[TortoiseWolfe]

Summary

Refs #51. The auth-race regression that's been reverted three times in ProtectedRoute (commits 6b4c13a, 2c97e67, 259b38d) survives via a defensive shape: a wasX.current ref that debounces transient flips, a cancelled flag in async effects, and a [user, ...] dep array that re-runs the check on identity change.

AdminGate (the admin RPC check that layers inside ProtectedRoute) implements the same defensive shape, but with zero test coverage. A future refactor could silently strip any of these defenses and CI would say "all green" — exactly how the prior regressions kept landing in the first place.

This PR pins those defenses as contracts. No behavior change; the bug shape that #51's body described as "latent stale closure" was actually already defended in code. The real gap was test coverage for that defense.

What changed

1. Extract AdminGate from src/app/admin/layout.tsx into src/app/admin/AdminGate.tsx so it's unit-testable in isolation. layout.tsx now just composes <ProtectedRoute><AdminGate>{children}</AdminGate></ProtectedRoute>.

2. Document the safety properties as a top-of-file comment naming each load-bearing ref/flag/dep so the next reader understands what must not be removed.

3. Add src/app/admin/AdminGate.test.tsx with 10 regression cases pinning each property:

   #	Property under test
   1	Loading spinner before authLoading resolves
   2	Loading spinner while admin check is in flight
   3	Children render on admin=true
   4	router.push('/') when admin=false on first mount (and never-was)
   5	wasAdmin.current debounce: no redirect on transient admin→non-admin flip
   6	Dep-array integrity: user.id change re-runs checkIsAdmin
   7	cancelled flag: no setState after unmount mid-flight
   8	Renders nothing (not the nav) when admin=false and never-was
   9	No admin check while authLoading is true
   10	No admin check when user is null

Out of scope (intentionally)

#51's original plan listed three more steps: pin user.id via a parallel userRef, hoist into a shared useAuthGate hook, and sweep the codebase for the same shape. After reading the code carefully, the first looks like premature optimization (the existing cancelled flag + dep array catches the failure mode the userRef would defend against). The second is a real DRY opportunity but warrants its own focused refactor PR. The third is a sweep that should run on a clean baseline — i.e., after this PR lands.

If the regression cases above ever fail in CI, that's the empirical justification for steps 2–4. Until then: YAGNI.

Test plan

• pnpm vitest run src/app/admin/AdminGate.test.tsx — 10/10 pass in 62ms
• pnpm vitest run src/app/admin src/components/auth tests/unit/services/admin tests/unit/auth — 36 files, 209 tests, all pass (including ProtectedRoute and AdminAuthService dependents)
• pnpm run type-check — clean
• pnpm exec eslint src/app/admin/* — clean

🤖 Generated with Claude Code