Merge branch 'main' of https://github.com/objectstack-ai/framework

Author: os-zhuang

.changeset/adr-0076-rev5.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+fix(auth): restore the admin gate on POST /admin/oauth-application/toggle-disabled after ADR-0068
+
+ADR-0068 stopped `customSession` from synthesizing `user.role = 'admin'`;
+canonical roles now arrive in `user.roles[]` with `user.isPlatformAdmin` as a
+derived alias. The OAuth-client enable/disable route was missed in that
+migration and still gated on `session.user.role !== 'admin'`, which now rejects
+even platform admins (the scalar is no longer synthesized). It now mirrors the
+sibling /admin/unlock-user gate: `isPlatformAdmin` / `platform_admin` in
+`roles[]`, with the legacy `role` scalar as a fallback.
+
+Also corrects the now-stale `customSession()` doc comment in auth-manager that
+still described the removed `user.role = 'admin'` overwrite.