fix(courses): use admin client for teacher course pages to fix RLS mismatch

The JWT's tenant_id claim (from app_metadata) doesn't match the actual
subdomain tenant ID. RLS get_tenant_id() reads JWT claims, so queries
return empty results even for valid courses. The middleware sets the
correct tenant ID via x-tenant-id header (getCurrentTenantId()), but
RLS can't use that.

Fix: use createAdminClient() for course detail page queries with manual
tenant_id filtering from the header. Auth is validated via
getCurrentUserId(). Ownership check remains on author_id.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: guillermoscript

app/[locale]/dashboard/teacher/courses/[courseId]/page.tsx

@@ -1,4 +1,4 @@
-import { createClient } from '@/lib/supabase/server'
+import { createAdminClient } from '@/lib/supabase/admin'
 import { redirect, notFound } from 'next/navigation'
 import Link from 'next/link'
 import { getTranslations } from 'next-intl/server'
@@ -33,7 +33,7 @@ interface PageProps {
 
 export default async function CourseManagementPage({ params }: PageProps) {
   const { courseId } = await params
-  const supabase = await createClient()
+  const supabase = createAdminClient()
   const t = await getTranslations('dashboard.teacher.manageCourse')
   const tenantId = await getCurrentTenantId()
 
@@ -42,7 +42,8 @@ export default async function CourseManagementPage({ params }: PageProps) {
     redirect('/auth/login')
   }
 
-  // Get course and verify ownership
+  // Use admin client — RLS get_tenant_id() reads JWT claims which may not match
+  // the actual subdomain tenant. We validate tenant ownership manually.
   const { data: course, error: courseError } = await supabase
     .from('courses')
     .select('*')