Harden admin route visibility: 404 not 403, redirect to /login

- deps.py: get_current_admin returns 404 Not Found for non-superusers instead
  of 403 Forbidden — hides endpoint existence from unauthorised callers
- App.tsx: AdminRoute redirects non-admins to /login instead of /, making
  the route indistinguishable from a non-existent page

Layer 3 (network-level IP restriction via Traefik) tracked in TODO.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/App.tsx

@@ -21,7 +21,8 @@ function AdminRoute({ children }: { children: React.ReactNode }) {
   if (!token) return <Navigate to="/login" replace />;
   // Wait for the me query before deciding — prevents a flash redirect
   if (isLoading) return null;
-  if (!user?.is_admin) return <Navigate to="/" replace />;
+  // Redirect to /login (not /) so the route appears not to exist
+  if (!user?.is_admin) return <Navigate to="/login" replace />;
   return <>{children}</>;
 }