fix: apply requireAdmin middleware to admin user management routes

[FLASH2332]

Problem

The /api/v1/admin/users/* routes only validated JWT signature and expiry via requireAuth,
but did not check the caller's role. Any authenticated driver could create, delete, and modify
all user accounts—including promoting themselves to admin or deleting other admins.

Solution

Applied the existing requireAdmin middleware to all five admin user management routes:

• GET /api/v1/admin/users
• GET /api/v1/admin/users/{id}
• POST /api/v1/admin/users
• PUT /api/v1/admin/users/{id}
• DELETE /api/v1/admin/users/{id}

Routes now use authMiddleware(adminMiddleware(...)) to verify both JWT validity and admin role.

Changes

• main.go: Wrapped all admin user routes with adminMiddleware

Security Impact

• Non-admin users now receive 403 Forbidden instead of succeeding
• Prevents privilege escalation and unauthorized data modification
• Aligns with existing admin route protection pattern (/api/v1/admin/status, /api/v1/admin/vehicles/*)

Closes #75