fix: grant admin role full access to logs, roles, delete, and role changes

Previously these actions were restricted to system role only. Admin and
system are now treated equally across: API logs view, user role editing,
user deletion, and role/permissions management. Regular users remain blocked.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/routes/logs.py

@@ -8,6 +8,7 @@ from sqlalchemy.orm import Session
 from web.auth.session import get_current_user
 from web.database import get_db
 from web.models.connections import ApiLog
+from web.models.user import UserRoleEnum
 from web.templates_env import templates
 
 router = APIRouter()
@@ -34,6 +35,8 @@ async def admin_logs(
         user = get_current_user(request, db)
     except Exception:
         return RedirectResponse("/login", 303)
+    if user.role not in (UserRoleEnum.admin, UserRoleEnum.system):
+        return RedirectResponse("/login", 303)
 
     since = datetime.utcnow() - timedelta(hours=hours)
     query = db.query(ApiLog).filter(ApiLog.created_at >= since)