fix: expose staging admin entry

Use persisted self-hosted roles and the isolated admin origin so authorized staging accounts can discover the protected admin surface.

frontend/tests/admin-contracts.test.ts

@@ -8,6 +8,7 @@ const migration = readFileSync(
 );
 const auth = readFileSync(new URL("../src/lib/admin/auth.ts", import.meta.url), "utf8");
 const authPolicy = readFileSync(new URL("../src/lib/admin/auth-policy.ts", import.meta.url), "utf8");
+const adminUser = readFileSync(new URL("../src/lib/supabase/admin.ts", import.meta.url), "utf8");
 const codesRoute = readFileSync(new URL("../src/app/api/admin/codes/route.ts", import.meta.url), "utf8");
 const codeRoute = readFileSync(new URL("../src/app/api/admin/codes/[id]/route.ts", import.meta.url), "utf8");
 const providers = readFileSync(new URL("../src/lib/admin/providers.ts", import.meta.url), "utf8");
@@ -27,6 +28,20 @@ test("admin APIs use persisted Better Auth roles with admin and viewer boundarie
   assert.match(codeRoute, /requireAdminSession\("write"\)/g);
 });
 
+test("self-hosted account entry checks persisted admin or viewer roles", () => {
+  const selfHostedBranch = adminUser.slice(
+    adminUser.indexOf('process.env.AUTH_PROVIDER?.trim() === "self-hosted"'),
+    adminUser.indexOf("if (isAdminEmail"),
+  );
+
+  assert.match(selfHostedBranch, /queryAdminRows/);
+  assert.match(selfHostedBranch, /select role from identity\.users where id = \$1 limit 1/);
+  assert.match(selfHostedBranch, /role === "admin" \|\| role === "viewer"/);
+  assert.doesNotMatch(selfHostedBranch, /isAdminEmail|ADMIN_EMAILS/);
+  assert.match(auth, /getIdentityAuthServices\(\)\.admin\.api/);
+  assert.match(auth, /authorizeAdminAccess\(user, access\)/);
+});
+
 test("readonly resources cannot be mutated through Refine access control", () => {
   for (const resource of ["users", "credit-transactions", "consultations", "audit-logs"]) {
     assert.match(providers, new RegExp(`"${resource}"`));