fix: restrict admin panel access to admin role by default (#791) (#795)

Add global requireAuth + requireRole middleware for all /admin/* routes
so only users with the admin role can access the admin panel. Previously
any authenticated user could reach the full admin UI.

Also adds a configurable `adminAccessRoles` option to SonicJSConfig for
developers who need to grant admin access to additional roles.

Closes #791

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: lane711

packages/core/src/app.ts

@@ -112,6 +112,10 @@ export interface SonicJSConfig {
     afterAuth?: Array<(c: Context, next: () => Promise<void>) => Promise<void>>
   }
 
+  // Admin access control
+  // Roles allowed to access the /admin panel. Defaults to ['admin'].
+  adminAccessRoles?: string[]
+
   // App metadata
   version?: string
   name?: string
@@ -192,9 +196,10 @@ export function createSonicJSApp(config: SonicJSConfig = {}): SonicJSApp {
     }
   }
 
-  // Admin panel: require authentication and admin role
+  // Admin panel access control: require authentication and admin role by default
+  const adminRoles = config.adminAccessRoles || ['admin']
   app.use('/admin/*', requireAuth())
-  app.use('/admin/*', requireRole(['admin']))
+  app.use('/admin/*', requireRole(adminRoles))
 
   // Plugin dynamic menu items for admin sidebar
   app.use('/admin/*', pluginMenuMiddleware())