fix(admin): preserve revoked owners and 503 status

Owner recovery lived in the identity-only migration path and could clear historical revocations on conflict. Admin layout also rethrew authorization 503s, turning service-unavailable failures into 500 responses.\n\nMove recovery behind the RBAC migration sequence, exclude revoked candidates without mutating their history, and terminate layout redirects at a no-store 503 route.

frontend/src/lib/admin/page-access.ts

@@ -3,7 +3,7 @@ export type AdminPageAuthorizationStatus = 401 | 403 | 503;
 export type AdminPageAccessFailure =
   | { kind: "login"; location: "/login" }
   | { kind: "forbidden"; status: 403; message: string }
-  | { kind: "unavailable"; status: 503; message: string };
+  | { kind: "unavailable"; status: 503; message: string; location: "/admin-unavailable" };
 
 export function resolveAdminPageAccessFailure(
   status: AdminPageAuthorizationStatus,
@@ -14,5 +14,10 @@ export function resolveAdminPageAccessFailure(
   if (status === 403) {
     return { kind: "forbidden", status, message: "无权访问后台" };
   }
-  return { kind: "unavailable", status, message: "后台服务暂时不可用" };
+  return {
+    kind: "unavailable",
+    status,
+    message: "后台服务暂时不可用",
+    location: "/admin-unavailable",
+  };
 }