fix: expose staging admin entry

Use persisted self-hosted roles and the isolated admin origin so authorized staging accounts can discover the protected admin surface.

frontend/tests/account-api.test.ts

@@ -27,6 +27,15 @@ test("account API reads and returns the server-configured rectification price",
   assert.doesNotMatch(source, /RECTIFICATION_PRICE_CREDITS[^\n]*\?\?\s*["']1["']/);
 });
 
+test("account API returns a server-resolved admin entry URL", () => {
+  assert.match(source, /readIdentityConfig\(process\.env\)/);
+  assert.match(source, /new URL\("\/admin\/codes", identityConfig\.adminOrigin\)\.toString\(\)/);
+  assert.match(source, /identityConfig\.provider === "self-hosted"/);
+  assert.match(source, /: "\/admin\/codes"/);
+  assert.match(source, /adminUrl,/);
+  assert.doesNotMatch(source, /NEXT_PUBLIC_ADMIN|process\.env\.AUTH_ADMIN_ORIGIN/);
+});
+
 test("account API projects only the minimum case state needed by the homepage", () => {
   const caseSelect = source.match(/\.from\("birth_time_rectification_cases"\)[\s\S]*?\.limit\(\d+\)/)?.[0] ?? "";