Fix: Always check admin status from access token in JWT callback

The jwt callback was only checking isAdmin during initial login when
account was present, but not on subsequent session refreshes. This caused
the admin status to be lost after the initial login.

- Moved admin status check outside of the 'if (account)' block
- Now checks isAdmin on every JWT callback when accessToken is available

frontend/src/auth/auth.ts

@@ -71,7 +71,10 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
         // Add clubs claim from Keycloak access token
         token.clubs = (account as { clubs?: Record<string, string> }).clubs || {}
         token.accessToken = account.access_token
+      }
 
+      // Always check admin status from the access token if available
+      if (token.accessToken) {
         try {
           const payload = JSON.parse(Buffer.from((token.accessToken as string).split('.')[1], 'base64').toString());
           const roles = (payload.realm_access?.roles as string[]) || [];