debug: add logging to trace auth issues

src/lib/admin-permissions.ts

@@ -40,6 +40,7 @@ export async function getAdminUser(): Promise<AdminUser | null> {
   try {
     const { data: session } = await getSession();
     sessionEmail = session?.user?.email ?? null;
+    console.log("[admin-permissions] Session email:", sessionEmail);
   } catch (err) {
     console.error("[admin-permissions] getSession() failed:", err);
     return null;
@@ -54,6 +55,7 @@ export async function getAdminUser(): Promise<AdminUser | null> {
         .from(adminUsers)
         .where(eq(adminUsers.email, sessionEmail.toLowerCase()))
         .limit(1);
+      console.log("[admin-permissions] User rows found:", userRows.length);
       const user = userRows[0];
       if (!user) return null;
 
@@ -71,6 +73,7 @@ export async function getAdminUser(): Promise<AdminUser | null> {
         .where(eq(adminUserBrands.adminUserId, user.id))
         .limit(1);
 
+      console.log("[admin-permissions] Membership rows found:", membershipRows.length);
       if (membershipRows.length === 0) {
         // Signed in but not provisioned for any brand.
         return null;