Anyone who is not the owner or a moderator gets 404 on GET and POST /admin, not 401/403 #137

Part of #12. The owner asked: "Non-admins get 404 on /admin". Main answers 401 to anonymous visitors and 403 to signed-in non-moderators (Software/so101/src/relay.ts, the renderRefusal lines), which tells a stranger the page exists.

Done:

• [ ] GET and POST /admin answer 404 with the app's ordinary not-found page for anonymous visitors and for signed-in people who are neither the owner nor a moderator.
• [ ] A moderator who POSTs a settings change still gets 403. They can see the page, so it is no secret to them.
• [ ] src/admin-relay.test.ts expectations for those cases change from 401/403 to 404; say so in the pull. New cases cover an anonymous GET and an anonymous POST.
• [ ] bun --cwd Software/so101 test and bun x tsc --noEmit pass.

Waits on the /admin move (#121, #122) so it edits src/admin-routes.ts, not relay.ts.