feat(flutter): wire admin routes + isAdmin gate

Adds /admin, /admin/requests, /admin/quarantine, /admin/users routes to
the ShellRoute (so PlayerBar persists). Redirect closure refuses any
/admin path when user.isAdmin is false. Server-side RequireAdmin
middleware remains the actual authority — this is UX.

Screens land in subsequent commits; this intermediate state won't build
until task 8/9 lands the AdminLandingScreen and the missing siblings
are stubbed out by task 11/13/16.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

flutter_client/lib/shared/routing.dart

@@ -17,6 +17,10 @@ import '../playlists/playlist_detail_screen.dart';
 import '../playlists/playlists_list_screen.dart';
 import '../search/search_screen.dart';
 import '../settings/settings_screen.dart';
+import '../admin/admin_landing_screen.dart';
+import '../admin/admin_requests_screen.dart';
+import '../admin/admin_quarantine_screen.dart';
+import '../admin/admin_users_screen.dart';
 import 'widgets/version_gate.dart';
 
 /// Exposed as a Provider so its single argument is a real `Ref` (the
@@ -39,6 +43,9 @@ GoRouter buildRouter(Ref ref) {
       if (user != null && (loc == '/login' || loc == '/server-url')) {
         return '/home';
       }
+      if (loc.startsWith('/admin') && !user!.isAdmin) {
+        return '/home';
+      }
       return null;
     },
     routes: [
@@ -68,6 +75,10 @@ GoRouter buildRouter(Ref ref) {
             path: '/playlists/:id',
             builder: (_, s) => PlaylistDetailScreen(id: s.pathParameters['id']!),
           ),
+          GoRoute(path: '/admin',            builder: (_, __) => const AdminLandingScreen()),
+          GoRoute(path: '/admin/requests',   builder: (_, __) => const AdminRequestsScreen()),
+          GoRoute(path: '/admin/quarantine', builder: (_, __) => const AdminQuarantineScreen()),
+          GoRoute(path: '/admin/users',      builder: (_, __) => const AdminUsersScreen()),
         ],
       ),
     ],