Verify and Strengthen Admin Route Authorization

[grantfox-oss]

Description:
Admin controllers check roles, but route definitions may still expose endpoints without explicit admin-only middleware. Audit admin.routes.ts and lock down all admin endpoints to prevent unauthorized access.

[GBOYEE]

Hi! I'd like to work on this issue.

I have experience with this stack and can deliver a clean, tested solution. Please assign this to me and I'll submit a PR shortly.

My approach:

• Analyze the root cause
• Implement a fix following existing code patterns
• Add tests and documentation

Thanks!