feat: restrict knowledge base to admins, add upload source metadata

[androemeda]

Locks down the /kb/* endpoints (previously public) to admin-role users only, and hides the sidebar's Admin section from non-admins.

• Add require_admin dependency (core/auth.py) that checks the Supabase role column after Auth0 verification; apply it to all /kb/* routes
• Add GET /users/me/role so the frontend can read the current user's role
• Hide the sidebar's Admin/Knowledge Base section unless role === "admin"
• Send the bearer token on the knowledge-base admin page's fetch calls (previously unauthenticated, would have broken once the backend started requiring auth)
• Add optional source_url and an uploaded_at timestamp to KB upload chunk payloads