P0: Role-gated routing ((client) and (admin) groups + middleware)

Imported from GitHub issue El-SaMa/oma#11 by @El-SaMa.

Create route groups and middleware that enforce role server-side; admin group requires staff role.

Done when: non-staff cannot access /admin and are redirected.