Add admin Activity page for curator audit reports.

Admins can filter and review curator_audit_log (date/time, actor, action, resource, details) via /api/audit against the environment DB.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/middleware/auth.js

@@ -79,6 +79,33 @@ function requirePermission(permission) {
   };
 }
 
+/** Active staff with role admin only. */
+async function requireAdmin(req, res, next) {
+  const userId = req.session?.userId;
+  if (!userId) {
+    return res.status(401).json({ error: 'Curator login required' });
+  }
+
+  try {
+    const user = await loadStaffUser(userId);
+    if (!user || !user.is_active) {
+      req.session.destroy(() => {});
+      return res.status(401).json({ error: 'Curator login required' });
+    }
+
+    attachStaff(req, user);
+
+    if (user.role !== 'admin') {
+      return res.status(403).json({ error: 'Admin access required' });
+    }
+
+    next();
+  } catch (err) {
+    console.error('Auth middleware error:', err.message);
+    res.status(500).json({ error: 'Authentication failed' });
+  }
+}
+
 function staffAuthPayload(user) {
   return {
     role: user.role,
@@ -90,6 +117,7 @@ function staffAuthPayload(user) {
 module.exports = {
   requireCurator,
   requirePermission,
+  requireAdmin,
   loadStaffUser,
   staffAuthPayload,
 };