Build `withAdminGuard()` HOC

   * 🔖 Labels: `frontend`, `security`
   * **Checklist:**

     * [ ] Read session via `next-auth`
     * [ ] Redirect non‑admins to `/unauthorized`
     * [ ] Wrap all admin pages
     * [ ] Add unit/integration tests