fix: admin RBAC, emergency fake data, search race condition, push not…

[Hahfyeex]

Summary

This PR addresses four independent frontend bugs across security, data integrity, UX correctness, and feature completeness.

---

#762 — Admin pages have no role-based access control

• Added role: UserRole field to the User interface in AuthContext.tsx
• Extended ProtectedRoute with a requireAdmin prop that redirects non-admins to /dashboard
• Wrapped all three admin pages (reports.tsx, security.tsx, sms.tsx) with <ProtectedRoute requireAdmin>
• Hidden the admin Reports nav link in Header.tsx behind a user?.role === 'admin' check

Closes #762

---

#757 — getPetEmergencyInfo silently returns fake hardcoded contacts on 404

• Removed getMockEmergencyInfo entirely from petAPI.ts
• getPetEmergencyInfo now returns null on 404 instead of fabricated data
• Updated scan/[id].tsx to render a clear "No Emergency Info Set Up" notice when emergency is null and no inline contact exists — a stranger scanning a tag gets an honest state rather than fictional phone numbers

Closes #757

---

#763 — Race condition in search: stale responses overwrite fresh results

• Added an AbortController ref to search.tsx
• Each handleSearch call cancels the previous in-flight request before issuing a new one
• AbortErrors are caught and ignored
• setIsLoading(false) only fires if the completing request is still the active one
• Controller is cleared when the user switches search-type tabs

Closes #763

---

#755 — Push notifications are fully stubbed out

• Restored real Firebase Cloud Messaging logic in firebase.ts (was fully commented out with a hard-coded return null)
• getFirebaseMessaging() now initialises the Firebase app and returns a Messaging instance, guarded by SSR, browser support, and missing-env-var checks
• Added firebase to package.json dependencies (was the root cause of the original stub)
• usePushNotifications and notificationService already wire up registerDeviceToken/removeDeviceToken correctly and will work once the package is installed

Closes #755

[drips-wave]

@Hahfyeex Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits