fix(admin): apply shared session inspection policy

[iscekic]

Change

Use the shared session-viewer procedure for admin webhook request inspection. Preserve existing configuration APIs and response contracts. Cover personal and organization scopes with database-backed router coverage and document the permission requirement for local fixtures.

Verification

• Targeted Jest run: 2 suites, 62 tests passed.
• Targeted oxlint: no warnings or errors.
• Local Next.js app exercised through the actual tRPC HTTP endpoint with local PostgreSQL fixtures and a loopback worker fixture. Both owner scopes completed the permission matrix; successful responses contained the locally seeded session mapping. Worker fixture call counts matched expectations.
• Web typecheck completed successfully.

Proxy answers

The owner's proxy gave these answers in the owner's place.

1. Question: Plan scope.
   Answer: Minimal middleware change; retain configuration APIs and resolver semantics.
   Confidence: 0.85 · Precedent: Prefer the smallest complete change without reducing quality.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• DEVELOPMENT.md
• apps/web/src/routers/admin-webhook-triggers-router.test.ts
• apps/web/src/routers/admin-webhook-triggers-router.ts

The listRequests switch to sessionViewerProcedure matches the existing getRequestLogs permission contract and the documented is_admin + can_view_sessions requirement; the new tests cover both personal and organization scopes, deny is_admin-only callers before any worker call, and resolve kiloSessionId correctly.

---

_{Reviewed by deepseek-v4.1-flash · Input: 44.2K · Output: 12.5K · Cached: 847.6K}

_{Review guidance: REVIEW.md from base branch main}