fix(admin): fresh SSR reads, atomic user delete + sanitized errors, cookie-rotation in middleware, no-store on admin APIs

lib/admin/response.ts

@@ -0,0 +1,13 @@
+import { NextResponse } from 'next/server';
+
+/**
+ * Wrapper around NextResponse.json that marks the response uncacheable. All
+ * admin API responses must never be stored by browsers, proxies, or Next's
+ * own caches, since they reflect privileged, frequently-changing state.
+ */
+export function jsonNoStore(body: unknown, init?: ResponseInit): NextResponse {
+  const res = NextResponse.json(body, init);
+  res.headers.set('Cache-Control', 'no-store');
+  res.headers.set('Pragma', 'no-cache');
+  return res;
+}