Show Admin nav only when GET /admin succeeds

Probe Authelia-protected /admin with credentials; keep the public
site free of admin links for anonymous visitors.

client/src/components/Layout.scss

@@ -55,6 +55,11 @@
     opacity: 0.85;
   }
 
+  &__admin {
+    color: var(--accent) !important;
+    font-weight: 500;
+  }
+
   &__burger {
     display: none;
     width: 40px;

client/src/components/Layout.tsx

@@ -1,17 +1,30 @@
 import { useEffect, useState } from "react";
 import { Link, NavLink, Outlet, useLocation } from "react-router-dom";
 import { api, type SiteSettings } from "../lib/api";
+import { canAccessAdmin } from "../lib/adminAccess";
 import "./Layout.scss";
 
 export function Layout() {
   const [site, setSite] = useState<SiteSettings | null>(null);
   const [menuOpen, setMenuOpen] = useState(false);
+  const [showAdmin, setShowAdmin] = useState(false);
   const location = useLocation();
 
   useEffect(() => {
     api.site().then(setSite).catch(() => setSite({ name: "jmartgraphix" }));
   }, []);
 
+  // Only surface Admin when Traefik/Authelia already allows GET /admin
+  useEffect(() => {
+    let cancelled = false;
+    canAccessAdmin().then((ok) => {
+      if (!cancelled) setShowAdmin(ok);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [location.pathname]);
+
   useEffect(() => {
     setMenuOpen(false);
   }, [location.pathname]);
@@ -47,6 +60,11 @@ export function Layout() {
             >
               ArtStation
             </a>
+            {showAdmin && (
+              <NavLink to="/admin" className="site-header__admin">
+                Admin
+              </NavLink>
+            )}
           </nav>
         </div>
       </header>