* fix(admin): pass auth token to getCommunitySettings and fix reorder body getCommunitySettings() was calling GET /api/admin/settings (which requires admin auth) without sending an Authorization header, causing 401 on /admin/settings and /admin/content-ratings. Added accessToken parameter and updated both call sites. Also fixed reorderOnboardingFields() sending { fields: [...] } when the backend expects a bare array. * fix(admin): add auth guard layout to prevent race condition All admin pages fired API calls on mount before AuthProvider finished its silent refresh, sending requests with null tokens and getting 401s. Added app/admin/layout.tsx that gates all /admin/* pages on auth state: shows loading skeleton while refreshing, redirects to /login if not authenticated, redirects to / if not admin. Child pages only mount once the access token is available. Updated content-ratings test to mock useAuth after the auth token fix.