fix: set cookie path to / so admin API routes receive the session

Cookie path was /admin, but admin API routes live under /api/admin/.
Browser only sends cookies to paths matching the cookie's path, so
all API calls were unauthenticated. Changed path to / for both
cookie creation (login) and deletion (logout).

src/app/api/admin/logout/route.ts

@@ -8,7 +8,7 @@ export async function POST() {
     httpOnly: true,
     secure: process.env.NODE_ENV === "production",
     sameSite: "lax",
-    path: "/admin",
+    path: "/",
     maxAge: 0,
   });
   return res;

src/lib/admin-session.ts

@@ -69,7 +69,7 @@ export function cookieOptions(value: string) {
     httpOnly: true,
     secure: process.env.NODE_ENV === "production",
     sameSite: "lax" as const,
-    path: "/admin",
+    path: "/",
   };
 }