feat: auth-aware UI and role-based access control (#67)

## Summary

- Add `is_admin` column to users table with Alembic migration and a `require_admin` FastAPI dependency that protects all admin-facing write endpoints (games, pokemon, evolutions, bosses, routes CRUD)
- Expose admin status to frontend via user API and update AuthContext to fetch/store `isAdmin` after login
- Make navigation menu auth-aware (different links for logged-out, logged-in, and admin users) and protect frontend routes with `ProtectedRoute` and `AdminRoute` components, preserving deep-linking through redirects
- Fix test reliability: `drop_all` before `create_all` to clear stale PostgreSQL enums from interrupted test runs
- Fix test auth: add `admin_client` fixture and use valid UUID for mock user so tests pass with new admin-protected endpoints

## Test plan

- [x] All 252 backend tests pass
- [ ] Verify non-admin users cannot access admin write endpoints (games, pokemon, evolutions, bosses CRUD)
- [ ] Verify admin users can access admin endpoints normally
- [ ] Verify navigation shows correct links for logged-out, logged-in, and admin states
- [ ] Verify `/admin/*` routes redirect non-admin users with a toast
- [ ] Verify `/runs/new` and `/genlockes/new` redirect unauthenticated users to login, then back after auth

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #67
Co-authored-by: Julian Tabel <juliantabel.jt@gmail.com>
Co-committed-by: Julian Tabel <juliantabel.jt@gmail.com>

backend/src/app/api/pokemon.py

@@ -3,6 +3,7 @@ from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import joinedload, selectinload
 
+from app.core.auth import AuthUser, require_admin
 from app.core.database import get_session
 from app.models.evolution import Evolution
 from app.models.pokemon import Pokemon
@@ -68,6 +69,7 @@ async def list_pokemon(
 async def bulk_import_pokemon(
     items: list[BulkImportItem],
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_admin),
 ):
     created = 0
     updated = 0
@@ -100,7 +102,9 @@ async def bulk_import_pokemon(
 
 @router.post("/pokemon", response_model=PokemonResponse, status_code=201)
 async def create_pokemon(
-    data: PokemonCreate, session: AsyncSession = Depends(get_session)
+    data: PokemonCreate,
+    session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_admin),
 ):
     existing = await session.execute(
         select(Pokemon).where(Pokemon.pokeapi_id == data.pokeapi_id)
@@ -321,6 +325,7 @@ async def update_pokemon(
     pokemon_id: int,
     data: PokemonUpdate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_admin),
 ):
     pokemon = await session.get(Pokemon, pokemon_id)
     if pokemon is None:
@@ -349,7 +354,11 @@ async def update_pokemon(
 
 
 @router.delete("/pokemon/{pokemon_id}", status_code=204)
-async def delete_pokemon(pokemon_id: int, session: AsyncSession = Depends(get_session)):
+async def delete_pokemon(
+    pokemon_id: int,
+    session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_admin),
+):
     result = await session.execute(
         select(Pokemon)
         .where(Pokemon.id == pokemon_id)
@@ -405,6 +414,7 @@ async def add_route_encounter(
     route_id: int,
     data: RouteEncounterCreate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_admin),
 ):
     route = await session.get(Route, route_id)
     if route is None:
@@ -436,6 +446,7 @@ async def update_route_encounter(
     encounter_id: int,
     data: RouteEncounterUpdate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_admin),
 ):
     result = await session.execute(
         select(RouteEncounter)
@@ -466,6 +477,7 @@ async def remove_route_encounter(
     route_id: int,
     encounter_id: int,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_admin),
 ):
     encounter = await session.execute(
         select(RouteEncounter).where(