62 admin sponsor edit permission middleware

[5sansiva]

Summary

Adds an AdminSponsorEditPermissionMiddleware and corresponding super admin toggle to gate sponsor mutation routes for admin-role users, following the same pattern as the existing AdminScheduleEditPermissionMiddleware.

Backend

• Middleware (cmd/api/middlewares.go): Added AdminSponsorEditPermissionMiddleware — blocks POST, PUT, and DELETE on /admin/sponsors for admin-role users when the toggle is disabled; super admins always bypass.
• Router (cmd/api/api.go): Wired the middleware onto sponsor mutation routes (POST /, PUT /{sponsorID}, DELETE /{sponsorID}, PUT /{sponsorID}/logo); GET / (list) remains unprotected.
• Toggle routes (cmd/api/settings.go): Added GET and POST /superadmin/settings/admin-sponsor-edit-toggle handlers with Swagger docs and request/response types (SetAdminSponsorEditTogglePayload, AdminSponsorEditToggleResponse).
• Store (internal/store/settings.go, storage.go): Added GetAdminSponsorEditEnabled and SetAdminSponsorEditEnabled with the admin_sponsor_edit_enabled settings key; uses upsert on the settings table (same as schedule toggle).
• Migration (cmd/migrate/migrations/000015_seed_admin_sponsor_edit_enabled): Seeds admin_sponsor_edit_enabled = true as the default.
• Mock store (internal/store/mock_store.go): Added mock implementations for both new store methods.

Tests

• Settings tests (cmd/api/settings_test.go): TestGetAdminSponsorEditToggle and TestSetAdminSponsorEditToggle covering enabled/disabled toggle reads and writes.
• Middleware permission tests (cmd/api/sponsors_test.go): TestSponsorMutationPermission covering admin blocked on create/update/delete/logo-upload when disabled, admin allowed when enabled, and super admin always allowed regardless of toggle state.