auth: replace copy-paste JWT checks with real middleware

[sumnerevans]

Summary

• Adds a shared parseTokenByIssuer helper that replaces the nearly-identical isAdminByToken and isVolunteerByToken functions
• Adds VolunteerAuthMiddleware mirroring the existing AdminAuthMiddleware
• Consolidates all protected admin routes (pages + API) into a single subrouter wrapped with AdminAuthMiddleware via StripPrefix("/admin", ...), consistent with the existing pattern
• Wraps volunteer scan/checkin routes with VolunteerAuthMiddleware
• Removes the duplicated cookie+token auth checks that were scattered across GetAdminTeamsTemplate, GetAdminDietaryRestrictionsTemplate, GetVolunteerScanTemplate, and HandleVolunteerCheckIn

Closes #73

Test plan

• GET /admin/teams without cookie → redirects to /admin/login
• GET /admin/dietaryrestrictions without cookie → redirects to /admin/login
• GET /admin/login without cookie → renders login page (unprotected)
• GET /volunteer/scan without cookie → redirects to /volunteer/login
• GET /volunteer/checkin without cookie → redirects to /volunteer/login
• Admin login flow → admin pages render correctly
• Volunteer login flow → volunteer scan page renders correctly

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Refactors admin/volunteer authentication to use shared JWT parsing and dedicated middleware, removing duplicated cookie/token checks from individual handlers and consolidating protected route registration.

Changes:

• Introduces parseTokenByIssuer and updates admin/volunteer login handlers to use it.
• Adds VolunteerAuthMiddleware and applies auth middleware to volunteer scan/checkin routes.
• Consolidates all protected admin pages + API endpoints under a single /admin/ subrouter wrapped with AdminAuthMiddleware, and simplifies template extra-data merging via maps.Copy.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
internal/volunteer.go	Removes inline volunteer auth checks; uses shared token parsing for volunteer/admin token validation.
internal/middleware.go	Adds shared JWT parsing helper; updates admin middleware redirect target; adds volunteer auth middleware.
internal/application.go	Consolidates protected admin routing under one subrouter + middleware; wraps volunteer routes with middleware; uses maps.Copy.
internal/admin.go	Removes inline admin auth checks; uses shared token parsing for admin login flow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This logs the raw login JWT from the query string. JWTs are bearer credentials and should not be written to logs (they can be replayed if leaked via log aggregation/support tooling). Please remove this field from logs or replace it with a safe surrogate (e.g., token hash / last few chars) and rely on request_id for correlation.

Suggested change

	log.Info().Str("token", tok).Msg("got token")
	log.Info().Msg("got admin login token")

[Copilot]

This logs the raw login JWT from the query string. JWTs are bearer credentials and should not be written to logs (they can be replayed if leaked via log aggregation/support tooling). Please remove this field from logs or replace it with a safe surrogate (e.g., token hash / last few chars) and rely on request_id for correlation.

Suggested change

	zerolog.Ctx(r.Context()).Info().Str("token", tok).Msg("got token")
	zerolog.Ctx(r.Context()).Info().Msg("received volunteer login token")