create roles/wire them to `/admin` API

### 🚀 Describe the new functionality needed

the admin API should only be accessible to users with proper permissions. use RBAC to enforce only the role of `admin` has access to routes within `/admin`

### 💡 Why is this needed? What if we don't build it?

without RBAC, `/admin` is not a true admin API, but is accessible to everyone.

### Other thoughts

_No response_