feat(web): add /admin layout with role-gated load + sidebar

Hard route gate in admin/+layout.ts redirects non-admins to / before
the layout (or any child) renders. AdminSidebar reads the active route
from $app/state and applies a 12% accent-tinted bg + 2px forest-teal
left strip on the active item. Overview landing shows pending-request
count and Lidarr connected/unset, each linking to its sub-page. Shell
nav exposes the Admin link only to is_admin users.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

web/src/routes/admin/+layout.ts

@@ -0,0 +1,13 @@
+import { redirect } from '@sveltejs/kit';
+import { user } from '$lib/auth/store.svelte';
+import type { LayoutLoad } from './$types';
+
+// Hard route gate: runs before the layout (and any child page) renders.
+// Auth is guaranteed bootstrapped by the root +layout.ts, so user.value is
+// either a settled User object or null.
+export const load: LayoutLoad = () => {
+  if (!user.value || !user.value.is_admin) {
+    throw redirect(302, '/');
+  }
+  return {};
+};