fix(permission-route): guard against /admin → /admin redirect loop

PermissionRoute unconditionally sent permission-failing users to /admin.
The current router wraps /admin in AdminRoute (no permission check), so
this never triggered. But if /admin ever picks up a PermissionRoute
guard — even by accident in a future change — the user would loop on
itself with replace history (no back-button escape).

Detect that case explicitly: if we're already on /admin and still failing
the permission check, fall back to / instead. Costs nothing today,
prevents a hard-to-diagnose lock-out later.

src/components/auth/PermissionRoute.tsx

@@ -58,7 +58,11 @@ export function PermissionRoute({
     }
 
     if (!hasAccess) {
-      return <Navigate to="/admin" replace />;
+      // Redirect back to the admin landing — unless we're already there
+      // (would loop) or the landing itself is what we lack permission for.
+      // Fall back to the user dashboard in that case.
+      const target = location.pathname === '/admin' ? '/' : '/admin';
+      return <Navigate to={target} replace />;
     }
   }