dev: vite proxy for '/admin' swallows the admin page itself, not just its API calls

Fixes the reported /admin MIME-type / NS_ERROR_CORRUPTED_CONTENT breakage on the
Vite dev server. The proxy matched by string prefix, so '/admin' also caught
'/admin' and '/admin.html' (the page requests), forwarding them to the backend
instead of letting Vite serve its own dev-mode HTML. In dev the backend only has
a stale production build (or none) to answer with, so the page loaded referencing
hashed prod asset paths that don't exist in Vite's dev module graph — Vite's dev
server then served its SPA-fallback HTML for those asset requests instead of JS.

Narrowed the proxy to the three backend-owned endpoints under /admin
(api/login/logout) so the bare page routes go through Vite's own dev serving.

client/vite.config.ts

@@ -32,8 +32,22 @@ export default defineConfig({
     port: 5173,
     proxy: {
       '/api': serverTarget,
-      '/admin': serverTarget,
       '/healthz': serverTarget,
+      // NOT a bare '/admin' prefix: that would also swallow the /admin and
+      // /admin.html *page* requests themselves (and, since Vite's proxy
+      // matches by string prefix, they do — '/admin' matches '/admin.html'
+      // too), forwarding them to the backend instead of letting Vite serve
+      // its own dev-mode admin.html. In dev the backend only has a stale
+      // production build to fall back on (or nothing, if `client` was never
+      // built), so the page ends up loaded with hashed prod asset paths that
+      // don't exist in Vite's dev module graph — Vite's dev server then
+      // answers those with its SPA-fallback HTML instead of JS, which is
+      // exactly the "wrong MIME type" / NS_ERROR_CORRUPTED_CONTENT failure
+      // reported for the admin page. Only the backend-owned endpoints need
+      // to cross the proxy.
+      '/admin/api': serverTarget,
+      '/admin/login': serverTarget,
+      '/admin/logout': serverTarget,
     },
   },
 });