Fix: Restrict /api/users/search to admin role to prevent PII leak

[builtbykabir]

Critical PII Data Leak in User Search (#449)

Closes #449

Changes Made

1. Role-Based Access Lock:
   • Modified the GET route in app/api/users/search/route.ts to strictly require the admin role.
   • Previously, the endpoint allowed both adventurer and admin roles, which inadvertently exposed unmasked user emails to any authenticated adventurer on the platform.
2. Preserved Administrative Functionality:
   • Instead of deleting the route entirely, the search functionality remains intact for future administrative features (e.g., moderation tools, user lookup panels, or support workflows).

Testing Notes

• Adventurer Access: Verified that attempting to query /api/users/search as a standard logged-in adventurer (or company) immediately returns a 401 Unauthorized response.
• Admin Access: Verified that authenticated administrators can still successfully query the endpoint and retrieve the expected JSON array of users.

[vercel]

@builtbykabir is attempting to deploy a commit to the larythelord's projects Team on Vercel.

A member of the Team first needs to authorize it.