Add route-wiring regression tests for admin middleware

[aaronbrethorst]

Background

PR #79 fixed a privilege-escalation bug where the /api/v1/admin/users/* routes were wired with authMiddleware but not adminMiddleware, letting any authenticated driver manage user accounts.

The requireAdmin middleware itself is well-covered (TestRequireAdmin_DriverDenied, TestRequireAdmin_MissingClaims, expired/invalid tokens). However, nothing tests that the routes in main.go are actually wrapped with that middleware. That wiring gap is exactly what caused the bug in #75/#79, and the same untested wiring also protects the /api/v1/admin/vehicles/* and /api/v1/admin/status routes.

Proposal

Add an integration-style test that builds the real mux (or a shared route-registration helper) and asserts that each /api/v1/admin/* route returns 403 Forbidden for a valid driver-role JWT. A table-driven test over the admin route list would prevent a future contributor from adding an admin route and forgetting the middleware.

Acceptance criteria

• Route registration is exercised by a test against the assembled handler
• Every /api/v1/admin/* route is asserted to reject a non-admin token with 403
• Test is table-driven so new admin routes are easy to cover

Follow-up to #79.

[FLASH2332]

I would like to work on this.