test(api): cover admin role gate

[pengyuayn]

What

Adds focused coverage for the admin role gate and allows super_admin to satisfy requireAdmin.

Why

Issue #405 asks for tests around the admin role hierarchy and 403 response shape. The current middleware only allowed admin, so a super_admin token was rejected even though the issue defines it as an admin superset.

How

• Updates requireAdmin to allow both admin and super_admin roles.
• Adds isolated Express middleware tests for admin, super_admin, user, brand, and missing role cases.
• Asserts forbidden responses are JSON and that the protected handler is not called on 403.

Test plan

• ./node_modules/.bin/vitest run apps/api/src/middleware/__tests__/require-admin.test.ts apps/api/src/middleware/require-admin.test.ts
• ./node_modules/.bin/prettier --check apps/api/src/middleware/require-admin.ts apps/api/src/middleware/__tests__/require-admin.test.ts
• ./node_modules/.bin/tsc -p apps/api/tsconfig.json --noEmit currently stops on an existing unrelated syntax error in apps/api/src/routes/leaderboard.ts.

Closes #405