[Cloud Service] Integrate Better Auth admin plugin and bootstrap super admin

[jacksonw111]

Goal

Add Better Auth admin management to cloud service and guarantee jacksonwen001@gmail.com is an admin.

Scope

• Enable admin plugin in auth server config
• Extend user schema fields: role, banned, banReason, banExpires
• Ensure signup/bootstrap logic grants admin role to jacksonwen001@gmail.com
• Add server-side admin checks in API layer
• Add minimal admin endpoints for listing users and role update (or expose Better Auth admin APIs in dashboard)

Acceptance Criteria

• Session for jacksonwen001@gmail.com carries admin capability
• Non-admin cannot access admin-only APIs
• Typecheck and build pass