test(admin): fix getAdminUser mock chain for admin_user_brands query

The pre-existing failing test (the one baseline failure that survived
across every refactor step) was a mock mismatch, not a code bug:

The real code in src/lib/admin-permissions.ts runs:
  db.select({...}).from(adminUserBrands).innerJoin(...).where(...)

…and awaits that result directly. The mock chain provided .where()
returning { limit: async () => [...] }, so what got awaited was the
{ limit } object — not an array. Memberships resolved to undefined,
membershipRows.length was undefined, membershipRows.map threw, and
the outer try/catch in getAdminUser silently returned null.

Fix: in both tests that exercise the membership branch, make the
.where() call itself the thenable (matches the real code shape).

Result: 175/175 tests pass (was 174/175 baseline).

tests/unit/getAdminUser.test.ts

@@ -97,12 +97,12 @@ describe("getAdminUser()", () => {
         }),
       })
       // Second select: adminUserBrands — returns empty
+      // The real code awaits `.from().innerJoin().where()` directly (no .limit()),
+      // so the mock makes `.where()` itself the thenable.
       .mockReturnValueOnce({
         from: () => ({
           innerJoin: () => ({
-            where: () => ({
+            where: async () => [],
-              limit: async () => [],
-            }),
           }),
         }),
       });
@@ -127,19 +127,18 @@ describe("getAdminUser()", () => {
           }),
         }),
       })
+      // The real code awaits `.from().innerJoin().where()` directly (no .limit()),
+      // so the mock makes `.where()` itself the thenable.
       .mockReturnValueOnce({
         from: () => ({
           innerJoin: () => ({
-            where: () => ({
+            where: async () => [
-              limit: async () => [
+              {
-                {
+                brandId: "brand-tux",
-                  brandId: "brand-tux",
+                brandName: "Tuxedo Citrus",
-                  brandName: "Tuxedo Citrus",
+                brandSlug: "tuxedo",
-                  brandSlug: "tuxedo",
+              },
-                  role: "brand_admin",
+            ],
-                },
-              ],
-            }),
           }),
         }),
       });