refactor: move admin route into middleware group and harden authorization

Move the admin panel route into the existing auth middleware group and
replace client-side redirects with server-side abort calls in the
Livewire component. Extract shared authorization logic into reusable
private methods.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/Livewire/Admin/Index.php

@@ -6,7 +6,6 @@ use App\Models\Team;
 use App\Models\User;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\Cache;
 use Livewire\Component;
 
 class Index extends Component
@@ -22,16 +21,15 @@ class Index extends Component
     public function mount()
     {
         if (! isCloud() && ! isDev()) {
-            return redirect()->route('dashboard');
-        }
-        if (Auth::id() !== 0 && ! session('impersonating')) {
-            return redirect()->route('dashboard');
+            abort(403);
         }
+        $this->authorizeAdminAccess();
         $this->getSubscribers();
     }
 
     public function back()
     {
+        $this->authorizeAdminAccess();
         if (session('impersonating')) {
             session()->forget('impersonating');
             $user = User::find(0);
@@ -45,6 +43,7 @@ class Index extends Component
 
     public function submitSearch()
     {
+        $this->authorizeAdminAccess();
         if ($this->search !== '') {
             $this->foundUsers = User::where(function ($query) {
                 $query->where('name', 'like', "%{$this->search}%")
@@ -61,19 +60,33 @@ class Index extends Component
 
     public function switchUser(int $user_id)
     {
-        if (Auth::id() !== 0) {
-            return redirect()->route('dashboard');
-        }
+        $this->authorizeRootOnly();
         session(['impersonating' => true]);
         $user = User::find($user_id);
+        if (! $user) {
+            abort(404);
+        }
         $team_to_switch_to = $user->teams->first();
-        // Cache::forget("team:{$user->id}");
         Auth::login($user);
         refreshSession($team_to_switch_to);
 
         return redirect(request()->header('Referer'));
     }
 
+    private function authorizeAdminAccess(): void
+    {
+        if (! Auth::check() || (Auth::id() !== 0 && ! session('impersonating'))) {
+            abort(403);
+        }
+    }
+
+    private function authorizeRootOnly(): void
+    {
+        if (! Auth::check() || Auth::id() !== 0) {
+            abort(403);
+        }
+    }
+
     public function render()
     {
         return view('livewire.admin.index');