Resolves and enforces admin access at the Plug boundary.
/admin and /admin/organizations/:org are distinct authorization paths.
This plug converts the route intent into a Sigra.Admin.Scope and assigns it
to the connection for downstream controller or mutation code.