Fix SEC-09: hide admin nav links from non-admin users

- Add IsAdmin bool to PageData (embedded in all page view structs)
- Remove redundant IsAdmin from DashboardData
- Add isAdmin() helper to derive admin status from request claims
- Set IsAdmin in all page-level handlers that populate PageData
- Wrap admin-only nav links in base.html with {{if .IsAdmin}}
- Add tests: non-admin dashboard/profile hide admin links,
  admin dashboard shows them

Security: navigation links to /accounts, /audit, /policies,
and /pgcreds are now only rendered for admin users. Server-side
authorization (requireAdminRole middleware) was already in place;
this change removes the information leak of showing links that
return 403 to non-admin users.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/ui/handlers_auth.go

@@ -281,6 +281,7 @@ func (u *UIServer) handleProfilePage(w http.ResponseWriter, r *http.Request) {
 		PageData: PageData{
 			CSRFToken: csrfToken,
 			ActorName: u.actorName(r),
+			IsAdmin:   isAdmin(r),
 		},
 	})
 }
@@ -393,6 +394,7 @@ func (u *UIServer) handleSelfChangePassword(w http.ResponseWriter, r *http.Reque
 		PageData: PageData{
 			CSRFToken: csrfToken,
 			ActorName: u.actorName(r),
+			IsAdmin:   isAdmin(r),
 			Flash:     "Password updated successfully. Other active sessions have been revoked.",
 		},
 	})