Add requireLogin and requireAdmin middlewares

Implement two authentication and authorization middlewares:
- requireLogin: checks req.session.userId and responds with 302 redirect to /admin/login
  for HTML requests, or 401 JSON for API requests
- requireAdmin: checks req.session.role === "admin" and responds with 403 for unauthorized access
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/middlewares/requireAdmin.js

+"use strict";
+module.exports = function requireAdmin(req, res, next) {
+  if (req.session && req.session.role === "admin") {
+    return next();
+  }
+  return res.status(403).send("Bạn không có quyền truy cập trang này.");
+};

app/middlewares/requireLogin.js

+"use strict";
+module.exports = function requireLogin(req, res, next) {
+  if (req.session && req.session.userId) {
+    return next();
+  }
+  if (req.is("json")) {
+    return res.status(401).json({ code: "99", data: "LOGIN_REQUIRED" });
+  }
+  return res.redirect("/admin/login");
+};