fix(admin-security): close the bearer-cookie ride; require session for admin gate (0.87.10)

Two follow-ups to 0.87.2 + 0.87.3 from the adversarial review:

1. **CSRF cookie-ride.** Bearer-bypass branch checked Authorization
   header presence only — an attacker page could mint `Authorization:
   Bearer junk` and ride the still-attached session cookie. Bypass now
   requires bearer AND no cookie. Drive the cookie-name comparison off
   `SESSION_COOKIE_NAME` and split on `=` (not prefix).

2. **`require_can_edit` admin path open to bearer.** Now reads admin
   authority off an `Option<CurrentSessionUser>` extractor — None on
   bearer-only requests. Owner-match path still accepts bearer; admin
   path is cookie-gated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/app.rs

@@ -1089,27 +1089,45 @@ async fn admin_csrf_guard(
         return Ok(next.run(req).await);
     }
     let headers = req.headers();
-    // Bearer-token requests are non-browser bot callers and bypass the
-    // gate entirely (the Authorization header is never set by an
-    // attacker page).
+
+    // Detect both auth modes BEFORE choosing a bypass. The previous
+    // version short-circuited on "is_bearer" regardless of cookie state,
+    // which let an attacker page do a credentialed cross-site POST with
+    // a forged `Authorization: Bearer junk` header: the header existed,
+    // CSRF bypassed, then the auth extractor authenticated the victim
+    // via the session cookie. Cookie precedence here re-anchors the
+    // gate to the actual authority being ridden.
+    // Drive the parse off the auth-module constant so a rename of
+    // `SESSION_COOKIE_NAME` propagates here instead of silently
+    // reopening the cookie-ride. Split on `=` (not a prefix match) so
+    // an attacker can't shadow with `mangalord_session_x=` etc.
+    let has_session_cookie = headers
+        .get(axum::http::header::COOKIE)
+        .and_then(|v| v.to_str().ok())
+        .is_some_and(|raw| {
+            raw.split(';').any(|p| {
+                p.trim_start().split('=').next()
+                    == Some(crate::auth::extractor::SESSION_COOKIE_NAME)
+            })
+        });
+
+    // Bearer-token-only requests are bot callers and bypass the gate —
+    // a browser can't set Authorization on a cross-site POST. But ONLY
+    // when no session cookie is also attached; with both present we
+    // must treat the request as cookie-auth to defeat the cookie-ride.
     let is_bearer = headers
         .get(axum::http::header::AUTHORIZATION)
         .and_then(|v| v.to_str().ok())
         .is_some_and(|v| v.trim_start().to_ascii_lowercase().starts_with("bearer "));
-    if is_bearer {
+    if is_bearer && !has_session_cookie {
         return Ok(next.run(req).await);
     }
-    // No session cookie either → let the auth extractor return a clean 401
+
+    // No auth context at all → let the auth extractor return a clean 401
     // ("log in first"). A no-auth request can't be a CSRF vector — there's
     // no authority to ride. Without this, an anonymous curl POST to an
     // admin endpoint surfaces 403 with our CSRF message instead of the
     // expected 401, which is confusing for both operators and tests.
-    let has_session_cookie = headers
-        .get(axum::http::header::COOKIE)
-        .and_then(|v| v.to_str().ok())
-        .is_some_and(|raw| raw.split(';').any(|p| {
-            p.trim_start().starts_with("mangalord_session=")
-        }));
     if !has_session_cookie {
         return Ok(next.run(req).await);
     }