fix: admin_required check DB direct en fallback (session cookie stale)

Le cookie de session peut dater d'avant le flag is_admin →
vérification DB directe si la session ne contient pas is_admin

app/routers/admin.py

@@ -9,8 +9,15 @@ router = APIRouter(tags=["admin"], prefix="/api/admin")
 async def admin_required(request: Request):
     from app.auth.session import get_current_user
     user = await get_current_user(request)
-    if not user or not user.get("is_admin"):
+    if not user:
         raise HTTPException(status_code=403, detail="Admin access required")
+    # Also check DB directly (session cookie may be stale)
+    if not user.get("is_admin"):
+        from app.db import get_conn
+        with get_conn() as conn:
+            row = conn.execute("SELECT is_admin FROM users WHERE id=?", (user.get("id"),)).fetchone()
+            if not row or not row["is_admin"]:
+                raise HTTPException(status_code=403, detail="Admin access required")
     return user