feat(admin): phase 5 — per-row quick actions for users + sessions

Hover-only action buttons (right-aligned, opacity transition, hidden on mobile).

- users.js: 4 actions (ban/unban, award coins, sessions, delete) — replaces `>` glyph cell, falls back to glyph for non-admin / self

- sessions.js: 2 actions (view, delete)

- DELETE /api/admin/sessions/:id (NEW): transactional (assignment_sessions=NULL, user_answers, session_questions, test_sessions), audit-logged, admin-only

- event.stopPropagation defence-in-depth (each button + parent .row-actions)

- LS.confirm for destructive ops; LS.modal for award-coins amount/reason

- CSS injected once via #row-actions-style id-dedup (same content in both sections)

Existing user-panel overlay + session toggle-drawer flows untouched (Phase 6 removes overlay).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/routes/admin.js

@@ -26,6 +26,7 @@ router.patch('/users/:id/ban',        ctrl.banUser);
 router.delete('/users/:id',           ctrl.deleteUser);
 router.get('/sessions',               ctrl.getAllSessions);
 router.get('/sessions/:id',           ctrl.getSessionDetail);
+router.delete('/sessions/:id',        ctrl.deleteSession);
 
 /* Audit log */
 router.get('/audit-log',              ctrl.getAuditLog);