- Wrap /runs/new and /genlockes/new with ProtectedRoute (requires login)
- Create AdminRoute component that checks isAdmin, redirects non-admins
with a toast notification
- Wrap all /admin/* routes with AdminRoute
- Deep-linking preserved: unauthenticated users redirect to login, then
back to the original protected route after auth
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add `is_admin` boolean column (default false) via Alembic migration
for role-based access control.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
