fix(auth): gate admin routes on the decoded path and in the actions themselves

test(e2e): add Playwright smoke test covering the core flows