Auth refactor 9/10 — Migrate the special services (contacts, admin, credits)

[pranavp10]

This ticket was generated by AI (to-tickets) from #43.

Parent

#43

What to build

Migrate the trickiest services last, once the pattern is proven (#49): contacts (already caches session validation — the behaviour we generalized), and admin + credits (platform-admin aware). This ticket also resolves the known open detail: the lean AuthContext omits email/name that admin's current middleware returns for audit logging (isPlatformAdmin is derivable from role), so decide whether admin does a separate lookup or uses a scoped richer context.

Acceptance criteria

• contacts, admin, credits mount @reloop/auth/middleware; old middleware deleted
• Platform-admin routes use the platformAdmin macro; role checks no longer hand-rolled
• admin's audit logging retains email/name via an explicit, documented mechanism (separate lookup or scoped context)
• Fail-closed default applied; org-optional/platform routes opt out explicitly
• Smoke test per service, including a platform-admin-only endpoint
• Tripwire (Auth refactor 1/10 — Test harness + characterization tripwire #44) still passes; services build green

Blocked by

• Auth refactor 6/10 — Pilot migration (one low-risk service) #49