Header was rendering all admin links unconditionally to every visitor
(including unauthenticated). Add an isAdmin state derived from
user_profiles.role (administrator|admin|super_admin) and wrap both the
desktop admin block and the mobile WP Import link in the guard.
Note: page-level auth checks on each /admin/* route remain authoritative;
this only suppresses menu visibility.
