fix: expose staging admin entry

Use persisted self-hosted roles and the isolated admin origin so authorized staging accounts can discover the protected admin surface.

frontend/src/lib/supabase/admin.ts

@@ -1,5 +1,6 @@
 import "server-only";
 
+import { queryAdminRows } from "@/lib/admin/database";
 import {
   createAdminSupabaseClient,
   isAdminEmail,
@@ -8,8 +9,23 @@ import {
 export { createAdminSupabaseClient, isAdminEmail };
 
 export async function isAdminUser(user: { id?: string; email?: string | null }) {
+  if (process.env.AUTH_PROVIDER?.trim() === "self-hosted") {
+    if (!user.id) return false;
+    try {
+      const rows = await queryAdminRows<{ role: string }>(
+        "select role from identity.users where id = $1 limit 1",
+        [user.id],
+      );
+      return rows[0]?.role
+        .split(",")
+        .map((role) => role.trim())
+        .some((role) => role === "admin" || role === "viewer") ?? false;
+    } catch {
+      return false;
+    }
+  }
   if (isAdminEmail(user.email)) return true;
-  if (process.env.AUTH_PROVIDER?.trim() === "self-hosted" || !user.id) return false;
+  if (!user.id) return false;
 
   try {
     const admin = createAdminSupabaseClient();