feat(admin): add RBAC identity and MFA controls

frontend/src/app/api/admin/session/route.ts

@@ -1,19 +1,21 @@
 import { NextResponse } from "next/server";
 
-import { requireAdminSession } from "@/lib/admin/auth";
+import { requirePermission } from "@/lib/admin/auth";
 import { adminErrorResponse } from "@/lib/admin/http";
 
 export const runtime = "nodejs";
 
 export async function GET() {
   try {
-    const { user, role } = await requireAdminSession();
+    const { user, roles, permissions, requiresMfa } = await requirePermission("admin.access");
     return NextResponse.json({
       user: {
         id: user.id,
         email: user.email,
         name: user.name,
-        role,
+        roles,
+        permissions,
+        requiresMfa,
       },
     });
   } catch (error) {