feat(role): add 'verwaltung' role with gated access to settings and tools

shop/app/admin/tools/page.tsx

@@ -11,6 +11,8 @@ import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/com
 import { Badge } from "@/components/ui/badge";
 import { Loader2, RefreshCw, Wrench, Database, AlertTriangle, CheckCircle2, XCircle, Terminal, ArrowLeft } from "lucide-react";
 import Link from "next/link";
+import { createClient } from "@/lib/supabase/client";
+import { useRouter } from "next/navigation";
 
 interface TableStatus {
   exists: boolean;
@@ -34,6 +36,8 @@ export default function AdminToolsPage() {
   const [isLoading, setIsLoading] = useState(false);
   const [logs, setLogs] = useState<string[]>([]);
   const [activeAction, setActiveAction] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+  const router = useRouter();
 
   const addLog = (message: string) => {
     const timestamp = new Date().toLocaleTimeString();
@@ -88,8 +92,31 @@ export default function AdminToolsPage() {
   };
 
   useEffect(() => {
-    loadStatus();
-  }, []);
+    async function checkAccess() {
+      const supabase = createClient();
+      const { data: { user } } = await supabase.auth.getUser();
+      if (!user) {
+        router.push('/auth/login');
+        return;
+      }
+      const { data: userData } = await supabase
+        .from('users')
+        .select('role')
+        .eq('id', user.id)
+        .single();
+      if (!userData || userData.role === 'verwaltung') {
+        router.push('/admin');
+        return;
+      }
+      setLoading(false);
+      loadStatus();
+    }
+    checkAccess();
+  }, [router]);
+
+  if (loading) {
+    return <div className="min-h-screen bg-[#020617] text-white flex justify-center items-center"><Loader2 className="w-8 h-8 animate-spin text-primary" /></div>;
+  }
 
   return (
     <div className="min-h-screen bg-[#020617] text-white px-4 py-12 relative overflow-hidden">