fix(auth): correctly check role name in isAdmin — roles from /auth/me are objects not strings

fix(auth): use absolute API_BASE URLs for auth and admin endpoints

fix(auth): wire api.setToken() on login, logout, and page reload

feat(auth): add AuthContext with JWT login/logout and role detection