Add backend admin authorization endpoints plan

[sardorcodev]

Plan backend-protected admin endpoints for future admin dashboard functionality.

Current status:

• Admin role exists.
• Frontend admin UI is demo/static.
• Backend admin APIs are not implemented.

Scope:

• Define what admin APIs are needed.
• Use existing require_admin dependency pattern.
• Avoid implementing fake admin actions.

Acceptance criteria:

• Admin API plan is documented.
• Required endpoints and permissions are listed.
• Demo/static admin limitations remain clear.