Prompt: actually protect your admin pages

Make access control on my protected routes real rather than cosmetic.

1. List every route that should be restricted, and show me exactly where
   each is enforced. Any route protected only by a conditional render or a
   client-side redirect is not protected — mark it clearly.
2. Enforce on the server: middleware or a check at the top of each route
   handler that verifies the session and the user's role before returning
   anything.
3. Enforce at the data layer too, so the rule holds even if a route is
   missed — Row Level Security policies that check role and ownership.
4. Store roles in a table the user cannot write to. If the role lives in
   client-editable user metadata, an ordinary user can promote themselves;
   fix that before anything else.
5. Return 404 rather than 403 for admin routes, so their existence is not
   confirmed to someone probing.

Show me a table: route, what enforces it now, and what an anonymous
visitor and a normal signed-in user each receive.