feat(frontend): /admin dashboard with users/mangas/system views (0.41.0)

Adds the SvelteKit /admin route tree backed by the admin endpoints
landed in PR 1-4. Pages: Overview (alerts + summary cards), Users
(list / promote-demote / delete), Mangas (list with sync state +
expandable per-chapter state), System (live disk/mem/cpu bars,
refreshing every 5s).

Security model: the backend's RequireAdmin extractor is the actual
boundary. /admin/+layout.ts calls getSystemStats() at load and
translates the response — 401 → redirect to /login, 403 → throw
SvelteKit error(403) which renders the framework error page. The
header's "Admin" link is hidden unless `session.user?.is_admin`,
but that's UX only.

Carries `is_admin: boolean` through to the frontend User TS type so
the header check works and so admin tables can show role per row.

Vitest covers lib/api/admin.ts (10 tests: list/delete/PATCH for
users, sync-state filter for mangas, nested chapter route, system
disk-nullable case). Playwright is intentionally deferred until the
routes stabilise — admin UI is operator-only and changes shape often
in v0.

frontend/src/routes/+layout.svelte

@@ -10,6 +10,7 @@
     import Bookmark from '@lucide/svelte/icons/bookmark';
     import FolderOpen from '@lucide/svelte/icons/folder-open';
     import LogOut from '@lucide/svelte/icons/log-out';
+    import Shield from '@lucide/svelte/icons/shield';
     import '$lib/styles/tokens.css';
 
     let { children } = $props();
@@ -86,6 +87,12 @@
             <FolderOpen size={18} aria-hidden="true" />
             <span>Collections</span>
         </a>
+        {#if session.user?.is_admin}
+            <a class="nav-link" href="/admin" data-testid="nav-admin">
+                <Shield size={18} aria-hidden="true" />
+                <span>Admin</span>
+            </a>
+        {/if}
     </nav>
     <div class="session" data-testid="session-area">
         {#if !session.loaded}