feat(web): add /admin layout with role-gated load + sidebar

Hard route gate in admin/+layout.ts redirects non-admins to / before
the layout (or any child) renders. AdminSidebar reads the active route
from $app/state and applies a 12% accent-tinted bg + 2px forest-teal
left strip on the active item. Overview landing shows pending-request
count and Lidarr connected/unset, each linking to its sub-page. Shell
nav exposes the Admin link only to is_admin users.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

web/src/lib/components/Shell.svelte

@@ -30,6 +30,13 @@
     { href: '/playlists',     label: 'Playlists' },
     { href: '/settings',      label: 'Settings' }
   ];
+
+  // Admin link sits between Playlists and Settings, only visible to admins.
+  const visibleNavItems = $derived(
+    user.value?.is_admin
+      ? [...navItems.slice(0, -1), { href: '/admin', label: 'Admin' }, navItems[navItems.length - 1]]
+      : navItems
+  );
 </script>
 
 <svelte:window onclick={() => (menuOpen = false)} onkeydown={(e) => e.key === 'Escape' && (menuOpen = false)} />
@@ -70,7 +77,7 @@
 
   <nav class="hidden w-48 border-r border-border bg-surface md:block">
     <ul class="p-2">
-      {#each navItems as item}
+      {#each visibleNavItems as item}
         <li>
           <a
             href={item.href}