AAI-182 refactor and clean up user/role checking to enable admin endpoints

[marius-mather]

Description

AAI-182: I started on implementing admin endpoints, but realised we needed a bit of a refactor of how we check users/roles. This PR contains an initial admin endpoint to show the approach, but also refactors our existing user checks.

Changes

• Implement a user_is_admin check that we can apply to all admin routes
• Set the list of Admin roles via config
• Initial /admin/users endpoint to demonstrate a route that requires admin
• Unit tests of admin checking/user endpoint
• Refactor of existing validation/user checks

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have added unit / integration tests that prove my fix is effective or that my feature works
• I have run all tests locally and they pass
• I have updated the documentation (if applicable)

How to Test Manually (if necessary)

Run uv run pytest

[amandazhuyilan]

Overall looks great - just a nick pick on linting...