- /login route did not exist, so /admin redirected to /api/login -> /login -> 404
- /api/auth/user still ran the Replit-era deterministic UUID hash on the session
id, so it never found the user; now reads the session directly
- admin logout posts to /api/auth/logout and returns to /login
