A test pins the admin gate: a person without `administer` gets a 403 before any admin handler runs #6852

src/http/admin_gate.ts guards /admin/, /api/v1/admin/ and /releases with its rollback, and nothing imports it in a test.

Done:

• [ ] test/admin-gate.test.ts: isAdminPath is true for the guarded paths and false for look-alikes (/administer, /api/v1/adminx, /releases.json).
• [ ] A signed-in person without administer gets 403 with one plain sentence: JSON on the API, a page in a browser; a POST to an admin route (e.g. a rollback) writes nothing.
• [ ] /releases.json answers a guest; an admin reaches the handlers unchanged.

Files: test/admin-gate.test.ts only.

Before pushing: bun x tsc --noEmit and the tests you add or touch; bun scripts/design-lint.ts if src/web/ changes. Small and single-purpose; tests never read the wall clock — pass now in.