Create Admin Module with Role-Based Access Control

[Mkalbani]

Description

Build an admin module that provides privileged management endpoints for internal operations. Admins need visibility across the entire platform — managing users, reviewing sessions, toggling features, and auditing rewards. This module consolidates admin-only functionality behind a single protected surface rather than scattering admin checks across every module.

Acceptance Criteria

• An admin module is scaffolded at src/admin/
• All routes require a valid JWT with role: admin
• GET /admin/users returns a paginated list of all users with account status
• PATCH /admin/users/:id/ban disables a user account
• GET /admin/sessions returns all sessions with filters for status and date range
• GET /admin/stats returns aggregate stats (total puzzles, sessions, rewards distributed)
• Admin actions are logged to an audit trail
• Unit tests cover access control, ban logic, and stats aggregation