fix(App.tsx): check user role before redirecting to /admin

- Staff users (role !== "customer") continue to redirect to /admin
- Customer users (role === "customer") see the portal at / instead
- Impersonation flow via ?sessionId= remains unaffected
- Dev mode (authDisabled=true) unchanged

Refs: GRO-1822

src/App.tsx

@@ -386,9 +386,10 @@ export function App() {
     return <Navigate to="/setup" replace />;
   }
 
-  // Redirect authenticated users to /admin (but preserve impersonation flow via ?sessionId=)
+  // Redirect authenticated staff (non-customer) users to /admin (but preserve impersonation flow via ?sessionId=)
   const searchParams = new URLSearchParams(location.search);
-  if (!authDisabled && session && !location.pathname.startsWith("/admin") && !searchParams.has("sessionId")) {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Better Auth session.user extends Record<string,unknown>; role field is injected by Authentik OIDC
+  if (!authDisabled && session && (session as any)?.user?.role !== "customer" && !location.pathname.startsWith("/admin") && !searchParams.has("sessionId")) {
     return <Navigate to="/admin" replace />;
   }