fix: toggle now works — JSON response + immediate CSS flip

- /toggle-admin returns JSON {ok, adminMode} instead of redirect
- onclick: toggle CSS instantly, then fetch, then reload on ok

ui/routes/auth.js

@@ -176,8 +176,7 @@ function createRouter({ auth, MOCK_USERS, authLimiter }) {
     if (!canAdmin) return res.status(403).send('Forbidden');
 
     req.session.adminMode = !req.session.adminMode;
-    // Редирект туда же откуда пришли
-    res.redirect(req.get('Referer') || '/');
+    res.json({ ok: true, adminMode: req.session.adminMode });
   });
 
   // GET /logout