feat(admin): integrate Next.js admin panel (admin-next/) from feat/nextjs-admin

- Add admin-next/: full Next.js + Prisma + shadcn admin panel (45 API routes, 76 components)
- docker-compose: tg_shop_admin service (port 3000, shared db/shop.db, prisma), bot talks to it via ADMIN_CHAT_URL=http://tg_shop_admin:3000/api/chat
- tor-proxy now proxies onion admin to tg_shop_admin:3000 (new panel)
- chatbotService: ADMIN_CHAT_URL default = http://tg_shop_admin:3000/api/chat (removed localhost:3100 anachronism)
- .env admin secrets gitignored (admin-next/.env)

admin-next/src/lib/auth-middleware.ts

@@ -0,0 +1,23 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { verifyToken, type AdminRole } from '@/lib/auth';
+
+export function getAuth(request: NextRequest): { role: AdminRole } | NextResponse {
+  const token = request.cookies.get('admin_token')?.value;
+  if (!token) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+  const payload = verifyToken(token);
+  if (!payload) {
+    return NextResponse.json({ error: 'Invalid or expired token' }, { status: 401 });
+  }
+  return { role: payload.role };
+}
+
+export function requireSuperAuth(request: NextRequest) {
+  const auth = getAuth(request);
+  if ('status' in auth) return auth;
+  if (auth.role !== 'super_admin') {
+    return NextResponse.json({ error: 'Super admin required' }, { status: 403 });
+  }
+  return auth;
+}