[FE-02] Enforce auth on admin routes via Next.js middleware - client-only guard is bypassable

[Leothosine]

Problem

frontend/app/(auth)/layout.tsx and frontend/app/(auth)/admin/layout.tsx are empty wrappers with no authentication check. ProtectedRoute only runs client-side JavaScript. A user who directly navigates to /admin/users receives and renders the full protected page before the client-side auth check can redirect them. Additionally, RoleProtectedPage returns null on a role mismatch instead of redirecting - the user sees a blank screen.

Proposed Solution

1. Create frontend/middleware.ts intercepting all requests matching /admin/*
2. Read the JWT from the accessToken cookie, verify it using jose (jwtVerify with JWT_SECRET)
3. Redirect unauthenticated requests to /login?redirect={originalPath}
4. Redirect role-violation requests to /admin/dashboard
5. Change RoleProtectedPage to call router.replace() instead of returning null

Acceptance Criteria

• Direct browser navigation to /admin/users with no session redirects to /login
• An expired token in the cookie triggers the redirect (verify exp claim)
• A staff role token navigating to a super_admin page redirects to /admin/dashboard
• Middleware matcher config excludes public routes (/api, /_next, /menu, etc.)
• Middleware latency does not exceed 5ms on average

[Menjay7]

Hi! I came across this issue and would love to work on it. I have experience with similar tasks and I'm confident I can investigate, implement a clean solution, and thoroughly test it before submitting a PR. If the issue is still open, I would appreciate it if you could assign it to me. Thank you!