fix: add /admin/check route, check isAdmin on login response, bump cache v8

Author: ddrayko

internal/embed/public/index.html

@@ -24,7 +24,7 @@
   </div>
 </div>
 
-  <script src="/js/app.js?v=7"></script>
-  <script src="/js/admin.js?v=7"></script>
+  <script src="/js/app.js?v=8"></script>
+  <script src="/js/admin.js?v=8"></script>
 </body>
 </html>

internal/embed/public/js/admin.js

@@ -321,6 +321,7 @@ async function handleAdminLogin(e) {
     let data;
     try { data = JSON.parse(text); } catch { throw new Error('Server error.'); }
     if (!res.ok) throw new Error(data.error || 'Invalid credentials.');
+    if (!data.user?.isAdmin) throw new Error('Admin access required.');
     adminState.token = data.token;
     adminState.user = data.user;
     localStorage.setItem(ADMIN_STORAGE_KEY, data.token);

internal/routes/admin.go

@@ -20,6 +20,7 @@ func RegisterAdminRoutes(r chi.Router) {
 	h := &AdminHandler{}
 
 	r.Post("/admin/login", http.HandlerFunc(h.AdminLogin))
+	r.Get("/admin/check", middleware.RequireAdmin(http.HandlerFunc(h.AdminCheck)))
 	r.Get("/admin/servers", middleware.RequireAdmin(http.HandlerFunc(h.ListAdminServers)))
 	r.Get("/admin/servers/{id}", middleware.RequireAdmin(http.HandlerFunc(h.GetAdminServer)))
 	r.Delete("/admin/servers/{id}", middleware.RequireAdmin(http.HandlerFunc(h.DeleteAdminServer)))
@@ -184,6 +185,18 @@ func (h *AdminHandler) AdminLogin(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+func (h *AdminHandler) AdminCheck(w http.ResponseWriter, r *http.Request) {
+	user := middleware.GetUser(r)
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"user": map[string]interface{}{
+			"id":        user.UserID,
+			"email":     user.Email,
+			"username":  user.Username,
+			"isAdmin":   user.IsAdmin,
+		},
+	})
+}
+
 func (h *AdminHandler) ListAdminServers(w http.ResponseWriter, r *http.Request) {
 	rows, err := database.DB.Query(`
 		SELECT sm.id, sm.ptero_server_id, sm.status, sm.created_at, sm.expires_at, sm.suspend_reason,