Smoke-check the admin authentication gate

Returns the AUTHENTICATED CALLER's own GitHub identity along with admin: true when (and only when) that caller (AuthInfo.UserID, joined to admins via users.github_id) has a row in the admins table (keyed on the immutable GitHub numeric ID, see migration 018). Used to confirm the admin gate is wired and working — the same auth.RequireAdmin middleware composes future admin-only routes (e.g., announcement CRUD, admin SSE). Team accounts B1 (issue #323) made non-owner admins possible, so this is NOT necessarily the identity of the account the request happens to be scoped to — a viewer/member admin inspecting another user's account sees their own identity here.

Responses split cleanly:

• 200 — caller is admin; payload includes the caller's own github_id/github_username (both null if the caller has no GitHub identity), and admin: true.
• 401 — produced by the upstream Bearer middleware when the request has no Authorization header or the token is invalid.
• 403 — opaque {"error":"forbidden"} when the request is authenticated but the account is not in the admins table. Same envelope on every non-admin path: do not leak whether the route requires admin or whether the caller happens to not be one.
• 429 — the global per-account rate limiter still applies to admin routes (200/min cap shared with the rest of /api/v1).

Admin membership is sourced from the immutable numeric GitHub ID (accounts.github_id), not the mutable username. A renamed admin retains access; a non-admin who happens to claim a freed username does not inherit it.