fix(gateway/services): admin node/render pages 500 — redirect loop + is_admin claim

- gateway proxy: trim trailing slash before forwarding upstream. gin's
  RedirectTrailingSlash adds /nodes → /nodes/ while render-svc redirects
  /nodes/ → /nodes, forming an infinite redirect loop (admin pages 500'd)
- accept is_admin as bool OR string "true" in render/file/notification/gateway
  auth middleware (identity emits it as a string) — admin endpoints were 403'ing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/render/internal/middleware/auth.go

@@ -43,7 +43,15 @@ func JWTAuth(secret string) gin.HandlerFunc {
 		}
 		userID, _ := uuid.Parse(fmt.Sprintf("%v", claims["sub"]))
 		tenantID, _ := uuid.Parse(fmt.Sprintf("%v", claims["tenant_id"]))
-		isAdmin, _ := claims["is_admin"].(bool)
+		// is_admin may arrive as a JSON bool or as the string "true" (identity emits a
+		// string). Accept both so [RequireAdmin] works regardless of token encoding.
+		isAdmin := false
+		switch v := claims["is_admin"].(type) {
+		case bool:
+			isAdmin = v
+		case string:
+			isAdmin = v == "true"
+		}
 		role, _ := claims["role"].(string)
 
 		c.Set(CtxUserID, userID)