fix: singleton Supabase admin client in requireAuth middleware

From the PR description

Summary

• Extracts a module-level _adminClient singleton from requireAuth - the client is lazy-initialised on first use and reused across all requests
• The service-role client is stateless (persistSession: false), so sharing it is safe
• Removes stray editResolutionLogging.test.ts that was copied from an unrelated branch and caused test failures on this branch

Closes #103 Closes #115 Closes #116 Closes #125

Changes

• backend/src/middleware/auth.ts - singleton admin client via getAdminClient()
• backend/src/middleware/__tests__/auth.test.ts - tests for 401 (missing header), 500 (missing env vars), and success path
• backend/vitest.config.ts - isolate: true added for consistent module isolation
• backend/package.json - "test": "vitest run" script added

Test plan

• Unit tests added and passing (3/3)
• Backend build passes