Admin console: show the signed-in operator's name, not "Administrator"

The user switcher fell back to "Administrator" whenever /admin/api/status
returned no currentUser. Fresh sign-ins already embed the verified Emby
account name in the session cookie, but a session minted before that field
existed (or one that has not been re-issued since) is valid yet anonymous,
so the fallback showed for ever.

handleAdminConsole now treats a valid-but-anonymous admin session as needing
a fresh sign-in for the SPA shell only — a one-time prompt that fills the
name in, since session renewal preserves whatever the cookie already held.
Asset requests are unaffected, so nothing breaks mid-session.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011wS9Qz3Fkxeu9KPt26hhhx

server/internal/api/admin_access_test.go

@@ -180,6 +180,37 @@ func TestAdminSignInAsksEmbyWhenTheAuthResponseCarriesNoPolicy(t *testing.T) {
 	}
 }
 
+// The user switcher names whoever is signed in, so an admin session must carry the
+// verified Emby account name. A fresh sign-in does; a session predating the identity in
+// the cookie is still valid but anonymous, and the console handler prompts those to sign
+// in again rather than falling back to "Administrator" for ever.
+func TestAdminSessionCarriesTheVerifiedName(t *testing.T) {
+	s := embyAccessLevel(t, `{"IsAdministrator":true}`, "")
+
+	cookie := sessionCookie(signIn(s, "/admin/"))
+	if cookie == nil {
+		t.Fatal("admin sign-in issued no session")
+	}
+	named := httptest.NewRequest(http.MethodGet, "/admin/", nil)
+	named.AddCookie(cookie)
+	if !s.adminSessionNamed(named) {
+		t.Fatal("a fresh admin session is missing the verified name")
+	}
+
+	anon, err := s.newBrowserSessionFor(adminSessionPurpose, adminSessionTTL, "")
+	if err != nil {
+		t.Fatalf("anonymous session: %v", err)
+	}
+	req := httptest.NewRequest(http.MethodGet, "/admin/", nil)
+	req.AddCookie(&http.Cookie{Name: installerCookieName, Value: anon})
+	if !s.validAdminSession(req) {
+		t.Fatal("an anonymous admin session should still be valid")
+	}
+	if s.adminSessionNamed(req) {
+		t.Fatal("an anonymous admin session should not report a name")
+	}
+}
+
 // And an Emby that will not answer either way must not be guessed at in the permissive
 // direction: no answer means no session.
 func TestAdminSignInIsRefusedWhenTheAccessLevelCannotBeRead(t *testing.T) {