Admin SSO: shared session with main site

- AdminJS uses main site session (no separate login)
- Login once at /auth/login → /admin accessible if role=admin
- Non-admin users redirected to /auth/login from /admin
- Removed separate AdminJS authentication (cookieName/cookiePassword)

lib/admin.js

@@ -193,27 +193,22 @@ async function setupAdmin(app) {
     ],
   });
 
-  // Auth: only admin users
-  const bcrypt = require('bcrypt');
-  const db = require('./db');
+  // Auth: use main site session — admin role required
+  const adminRouter = AdminJSExpress.buildRouter(adminJs);
 
-  const adminRouter = AdminJSExpress.buildAuthenticatedRouter(adminJs, {
-    authenticate: async (email, password) => {
-      const user = await db.findUserByEmail(email);
-      if (!user || user.role !== 'admin') return null;
-      const valid = await bcrypt.compare(password, user.password_hash);
-      if (!valid) return null;
-      return { email: user.email, role: user.role, id: user.id };
-    },
-    cookieName: 'adminjs',
-    cookiePassword: process.env.SESSION_SECRET || 'adminjs-secret-change-me',
-  }, null, {
-    resave: false,
-    saveUninitialized: false,
-    secret: process.env.SESSION_SECRET || 'adminjs-secret-change-me',
-  });
+  // Middleware: check main session for admin role before AdminJS
+  app.use(adminJs.options.rootPath, (req, res, next) => {
+    // Allow AdminJS static assets (js, css, etc.)
+    if (req.path.match(/\.(js|css|png|svg|ico|map|woff|woff2|ttf)$/)) return next();
 
-  app.use(adminJs.options.rootPath, adminRouter);
+    if (req.session && req.session.user && req.session.user.role === 'admin') {
+      return next();
+    }
+
+    // Not admin — redirect to login with return URL
+    req.session.returnTo = '/admin';
+    return res.redirect('/auth/login');
+  }, adminRouter);
 
   return adminJs;
 }