[L-4] AdminMiddleware re-queries user instead of using AuthMiddleware's validation

Resolved.

AdminMiddleware now refuses access unless $_SESSION['_auth_validated_at'] is set — a cheap sentinel that AuthMiddleware writes on every successful validation pass. If someone ever rearranges the middleware order and AdminMiddleware runs without AuthMiddleware having validated the session first, admin access is denied rather than silently allowed based on a stale $_SESSION['user_id'].

Current route registrations put AuthMiddleware first, so there's no behavioural change in production — this is a defence-in-depth guard against future misconfig.

Locking this thread.