fix(admin): fresh SSR reads, atomic user delete + sanitized errors, cookie-rotation in middleware, no-store on admin APIs

lib/auth/admin-guard.ts

@@ -1,7 +1,8 @@
 import { redirect } from 'next/navigation';
-import { NextResponse } from 'next/server';
+import type { NextResponse } from 'next/server';
 import type { User } from '@supabase/supabase-js';
 import { createSupabaseServerClient } from '@/lib/supabase/server';
+import { jsonNoStore } from '@/lib/admin/response';
 
 export function isAdmin(user: User | null | undefined): boolean {
   return user?.app_metadata?.role === 'admin';
@@ -35,13 +36,13 @@ export async function requireAdminApi(): Promise<
   if (!user) {
     return {
       ok: false,
-      response: NextResponse.json({ error: 'unauthorized' }, { status: 401 }),
+      response: jsonNoStore({ error: 'unauthorized' }, { status: 401 }),
     };
   }
   if (!isAdmin(user)) {
     return {
       ok: false,
-      response: NextResponse.json({ error: 'forbidden' }, { status: 403 }),
+      response: jsonNoStore({ error: 'forbidden' }, { status: 403 }),
     };
   }
   return { ok: true, user };