harden admin api authorization and add authz regression tests

apps/admin/src/lib/clerk-helpers.ts

@@ -1,11 +1,7 @@
 import { clerkClient } from "@clerk/nextjs/server";
+import { type UserRole } from "@fitai/shared";
 import log from "./logger";
 
-/**
- * User roles available in the application
- */
-export type UserRole = "admin" | "trainer" | "client";
-
 /**
  * Set a user's role in Clerk public metadata
  * This will trigger a webhook that syncs the role to the database
@@ -71,7 +67,8 @@ export async function hasRole(
  * const isAdmin = await isAdmin('user_abc123');
  */
 export async function isAdmin(userId: string): Promise<boolean> {
-  return hasRole(userId, "admin");
+  const role = await getUserRole(userId);
+  return role === "admin" || role === "superAdmin";
 }
 
 /**
@@ -161,6 +158,7 @@ export async function getUserCountByRole(): Promise<Record<UserRole, number>> {
   const { data: users } = await client.users.getUserList();
 
   const counts: Record<UserRole, number> = {
+    superAdmin: 0,
     admin: 0,
     trainer: 0,
     client: 0,