fix(gateway/services): admin node/render pages 500 — redirect loop + is_admin claim

- gateway proxy: trim trailing slash before forwarding upstream. gin's
  RedirectTrailingSlash adds /nodes → /nodes/ while render-svc redirects
  /nodes/ → /nodes, forming an infinite redirect loop (admin pages 500'd)
- accept is_admin as bool OR string "true" in render/file/notification/gateway
  auth middleware (identity emits it as a string) — admin endpoints were 403'ing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/gateway/internal/proxy/proxy.go

@@ -38,6 +38,13 @@ func New(name, target string) *Upstream {
 	orig := rp.Director
 	rp.Director = func(req *http.Request) {
 		orig(req)
+		// Normalise away a trailing slash (gin's RedirectTrailingSlash adds one when a
+		// route is registered as catch-all, e.g. /v1/nodes/*path, but upstream services
+		// register the canonical no-slash form and redirect /nodes/ → /nodes — without
+		// this the two redirects form an infinite loop).
+		if len(req.URL.Path) > 1 && strings.HasSuffix(req.URL.Path, "/") {
+			req.URL.Path = strings.TrimRight(req.URL.Path, "/")
+		}
 		req.Header.Set("X-Forwarded-Host", req.Host)
 		req.Header.Del("X-Forwarded-For") // let httputil re-add it properly
 		req.Host = u.Host