feat: allow sync admin check

[frodi-karlsson]

allows this example usage:

const admin = await adminService.resolveAdmin(req) // once per request

const result = adminService.checkPermissions(admin, ['MY_ROLE'])
const adminInfo = adminService.requireGranted(result) // sync, throws 401/403

it moves logging responsibilities to the caller to decouple from the request:

const result = adminService.checkPermissions(admin, reqPermissions)
if (result.email && !result.authDisabled) {
  logger.log(`${result.email} permissions check: ${result.granted ? 'GRANTED' : 'DENIED'}`)
}
return adminService.requireGranted(result)

[Copilot]

Copilot review overview

🔵 Needs a closer look

The refactor affects central authentication and authorization enforcement, warranting final human security review.

Review effort: Balanced
Findings: None

What changed in this PR

Adds synchronous permission evaluation after resolving an administrator once per request.

Changes:

• Introduces resolveAdmin, checkPermissions, and requireGranted.
• Preserves existing asynchronous permission APIs and adds focused tests.
• Adds a reusable request mock and removes a stale pnpm trust exclusion.

File	Description
pnpm-workspace.yaml	Removes an obsolete package trust-policy exception.
packages/​backend-lib/​src/​test/​mocks.ts	Adds a lightweight BackendRequest test helper.
packages/​backend-lib/​src/​admin/​base.admin.service.ts	Separates admin resolution, permission checks, and enforcement.
packages/​backend-lib/​src/​admin/​admin.resource.test.ts	Tests the new permission workflow and compatibility paths.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kirillgroshkov]

I trust that you know what you're doing.
The API looks good.