feat(admin): add layout server auth guard and Phase 1 hotfixes

- +layout.server.ts: auth guard (throws 403 for non-admin) with granular
  permission flags and entity counts for EntityNav
- GroupsTab: add ⚙ prefix to ADMIN badge (WCAG 1.4.1, non-color indicator)
- TagsTab: remove opacity-0 from action buttons (hidden on touch devices)
- +layout.svelte: remove unused isSystem derived

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/admin/+layout.svelte

@@ -1,10 +1,7 @@
 <script lang="ts">
-import { page } from '$app/state';
 import EntityNav from './EntityNav.svelte';
 
 let { data, children } = $props();
-
-const isSystem = $derived(page.url.pathname.startsWith('/admin/system'));
 </script>
 
 <svelte:head>