Restrict the self-host Admin area to admins

[baggiiiie]

Summary

plain self-hosted members could see Admin in the sidebar, and opening it rendered the workspace member directory before the invite API refused them.

this change makes the self-host Admin entry role-aware and replaces direct /admin access with an explicit denial before member details or admin controls render.

before

after

Linked issue

Fixes #1900

Verification

• changed-file format check
• bun run lint
• self-host and e2e typecheck
• self-host tests — 153 passed
• e2e — Admin · the self-hosted admin area is visible and accessible only to admins — recording
• existing e2e — Admin · a self-hosted owner sees the workspace's users; an invited member is refused

Checklist

• Added a changeset (bun run changeset), or this change needs none.
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.