feat(admin): phase 5 — per-row quick actions for users + sessions

Hover-only action buttons (right-aligned, opacity transition, hidden on mobile).

- users.js: 4 actions (ban/unban, award coins, sessions, delete) — replaces `>` glyph cell, falls back to glyph for non-admin / self

- sessions.js: 2 actions (view, delete)

- DELETE /api/admin/sessions/:id (NEW): transactional (assignment_sessions=NULL, user_answers, session_questions, test_sessions), audit-logged, admin-only

- event.stopPropagation defence-in-depth (each button + parent .row-actions)

- LS.confirm for destructive ops; LS.modal for award-coins amount/reason

- CSS injected once via #row-actions-style id-dedup (same content in both sections)

Existing user-panel overlay + session toggle-drawer flows untouched (Phase 6 removes overlay).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

js/api.js

@@ -175,6 +175,7 @@ async function adminGetSessions(params = {}) {
   return req('GET', `/admin/sessions?${p}`);
 }
 async function adminGetSessionDetail(id)    { return req('GET',   `/admin/sessions/${id}`); }
+async function adminDeleteSession(id)       { return req('DELETE',`/admin/sessions/${id}`); }
 async function adminClearUserSessions(id)  { return req('POST', `/admin/users/${id}/sessions/clear`); }
 async function adminUpdateUser(id, data)   { return req('PATCH',  `/admin/users/${id}`, data); }
 async function adminBanUser(id, banned)    { return req('PATCH',  `/admin/users/${id}/ban`, { banned }); }
@@ -944,7 +945,7 @@ window.LS = {
   register, login, fetchMe, updateProfile,
   getSubjects, updateSubject, getTopics,
   startSession, sendAnswer, finishSession, getResult, getHistory, getWeakTopics, getStudentStats, getSessionQuestions,
-  adminGetStats, adminGetOverview, adminGlobalSearch, adminGetUsers, adminUpdateRole, adminGetUserSessions, adminGetSessions, adminGetSessionDetail, adminClearUserSessions, adminUpdateUser, adminBanUser, adminDeleteUser,
+  adminGetStats, adminGetOverview, adminGlobalSearch, adminGetUsers, adminUpdateRole, adminGetUserSessions, adminGetSessions, adminGetSessionDetail, adminDeleteSession, adminClearUserSessions, adminUpdateUser, adminBanUser, adminDeleteUser,
   getQuestions, createQuestion, duplicateQuestion, updateQuestion, deleteQuestion, importQuestions,
   getClasses, createClass, getClassDetail, updateClass, deleteClass, kickMember, addClassMember, createAssignment, createDirectAssignment, updateAssignment, deleteAssignment,
   regenerateInviteCode, classJournal,