fix(admin-auth): reuse exact same QR/session API and component for admin login

- Removed invented adminAuthApiUrl endpoint and separate AdminLoginComponent.
  Admin login now uses the exact same Telegram session backend
  (TelegramSessionApiService, {authApiUrl}/users/sessions) and the exact
  same TelegramLoginComponent (mode="customer" | "admin" input) as customer
  login - only the storage (cookie/localStorage/signals) stays separate.
- Extracted the shared HTTP+normalization logic from AuthService into
  TelegramSessionApiService so both AuthService and AdminAuthService call it
  instead of duplicating request/parsing code.
- Documented the resulting backend gap in docs/Project-Editor.md: since the
  session API has no concept of "admin", server-side role enforcement is
  required when admin API calls are made - the frontend only decides where
  to store the session, not whether the user is actually an admin.

src/app/models/admin-auth.model.ts

@@ -1,16 +1 @@
-export interface AdminSession {
-  sessionId: string;
-  adminId: number | null;
-  username: string | null;
-  displayName: string;
-  role: string | null;
-  active: boolean;
-  expires: string;
-}
-
-export interface AdminWebSessionStart {
-  webSessionID: string;
-  url: string;
-}
-
 export type AdminAuthStatus = 'unknown' | 'checking' | 'authenticated' | 'expired' | 'unauthenticated';