Implement two authentication and authorization middlewares:
- requireLogin: checks req.session.userId and responds with 302 redirect to /admin/login
  for HTML requests, or 401 JSON for API requests
- requireAdmin: checks req.session.role === "admin" and responds with 403 for unauthorized access
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>