feat(admin): hide the entire admin panel from non-admins

leaderboard: serve renders from the public bucket, not the dataset proxy

Serve rotating WebP turntables + GT generator

leaderboard: open reports in new tab

gallery: searchable fixture picker, URL-persisted picks, cached render proxies

gallery: refresh after admin changes

admin: refresh table on auth load

leaderboard: drop silent fallback; boot resilient on Hub read failure

app: render reports inline via iframe srcdoc (private-Space safe)

app+leaderboard: link submission_name to a Space-side report proxy