Feature: Admin permissions to access the test page

[andrea-chirillano]

The debug page /test (which exposes auth test endpoints and project data) was accessible to any logged-in user. This change restricts it to admin users only, on both frontend and backend, and adds a 403 error page for users without permission.

Changes

Backend — backend/app/api/routes/test.py

• The /me and /osm endpoints now require AdminUser (previously CurrentUser), using the existing require_admin mechanism from hotosm_auth_fastapi, which validates the user's email against the ADMIN_EMAILS whitelist.
• Automatically returns 403 for any authenticated user whose email isn't in ADMIN_EMAILS. This is the real source of truth: even if the API is called directly (bypassing the frontend), it stays blocked.

Frontend — frontend/src/routes/index.tsx, frontend/src/pages/ForbiddenPage.tsx

• New AdminRoute component that, in addition to checking login state, queries /api/test/me to confirm the user is an admin before rendering TestPage.
• The /:locale/test route now uses AdminRoute instead of ProtectedRoute.
• New ForbiddenPage.tsx (403 / Access denied), same visual pattern as NotFoundPage.tsx. Shown when a logged-in non-admin user tries to access /test.

No CORS changes: this restriction is role-based authorization, not cross-origin — CORSMiddleware/allow_origins are untouched.

Environment / deploy requirements

ADMIN_EMAILS (comma-separated list of emails) was already consumed by require_admin, but until now it didn't gate any portal endpoint — this PR is its first real consumer. Needs to be set up/confirmed in each environment:

• Local (hot-dev-env): add to hot-dev-env/.env (not portal/.env — that file isn't used by the hot-dev-env stack):

  ADMIN_EMAILS=admin@hotosm.org,<other-local-admin-emails>
  

  Then recreate the container: docker compose up -d --force-recreate portal-backend (a plain restart won't apply the new value, since docker-compose's ${ADMIN_EMAILS} interpolation is resolved at container creation time).

• Staging and production (GitHub Actions): confirm the ADMIN_EMAILS secret is configured in the repo with the real admin emails for each environment. It's already referenced in deploy-testing.yml and deploy-production.yml (secrets.ADMIN_EMAILS), but if the secret was never set with real values, those environments will have no effective admin until it's added.

Test plan

• Backend: curl to /api/test/me with a non-admin user's cookie → 403. With an ADMIN_EMAILS-listed user's cookie → 200.
• Frontend: non-admin logged-in user visiting /test → sees ForbiddenPage (403). Admin user → sees TestPage normally. Logged-out user → still redirects to home (unchanged).
• pnpm test (frontend) and pytest (backend) with no regressions.