fix: return admin role from session endpoint when auth is disabled

The GET /api/auth/session endpoint still returned role "user" and
user-level permissions when AUTH_ENABLED=false, inconsistent with the
middleware which now assigns role "admin". Fix the session endpoint to
match so API clients get the correct role.

apps/api/src/plugins/auth.ts

@@ -297,9 +297,9 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
         user: {
           id: "anonymous",
           username: "anonymous",
-          role: "user",
+          role: "admin",
           mustChangePassword: false,
-          permissions: getPermissions("user"),
+          permissions: getPermissions("admin"),
           analyticsEnabled: null,
           analyticsConsentShownAt: null,
           analyticsConsentRemindAt: null,