feat: add gating for admin access

[Bran18]

Hardens access to /dashboard/admin with layered defense-in-depth so non-admin wallets never receive admin UI markup or data, even briefly.

Previously, the admin panel relied on a single client-side useEffect redirect in AdminPageClient, reading NEXT_PUBLIC_LENDING_ADMIN_ADDRESS. That meant the admin address shipped in the client bundle, admin forms were statically imported, and unauthorized users could see a flash of admin shell content before redirect.

This PR adds:

Middleware gate — redirects requests to /dashboard/admin when LENDING_ADMIN_ADDRESS is unset or the neko-stellar-address cookie does not match the admin wallet
Server page gate — page.tsx redirects when admin is not configured
Client AdminGate — waits for wallet store hydration, re-checks the connected address, and only then dynamically imports AdminPanel (pool state, treasury, collateral/interest forms)
Wallet cookie sync — sets/clears neko-stellar-address on connect/disconnect and backfills from persisted localStorage sessions
Server-only admin env — moves NEXT_PUBLIC_LENDING_ADMIN_ADDRESS → LENDING_ADMIN_ADDRESS (not a secret, but no longer bundled as a client gate constant); nav receives the address via server layout props
On-chain contract auth remains the real security boundary for privileged mutations. These layers prevent leaking the admin surface/UX and avoid relying solely on client-side redirects.

Migration: rename NEXT_PUBLIC_LENDING_ADMIN_ADDRESS to LENDING_ADMIN_ADDRESS in .env.local. Admin must connect their wallet (sets the cookie) before visiting /dashboard/admin.

Closes #272

[vercel]

@Bran18 is attempting to deploy a commit to the Oppia Software Labs Team on Vercel.

A member of the Team first needs to authorize it.