Role exposed to client session

  • requireUser() helper to guard server actions
  • Admin enforcement: middleware in middleware.ts for /admin and /api/admin/* routes
  • Server-side checks across actions and API handlers