Private admin access for operations, incentives, and rewards health.

This workspace uses Supabase auth plus a server-side role check against protected admin records. Only enabled admin accounts can proceed.