Show Secrets to superusers only, and guard its route as Admin is

The page reads GET /secrets/, which is a superuser's, so any other account
opened it onto a permission error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

frontend/src/components/Sidebar/AppSidebar.tsx

@@ -70,9 +70,11 @@ export function AppSidebar() {
   // depend on where the caret happens to be.
   useShortcuts({ "mod+k": () => setSearchOpen((open) => !open) }, ["mod+k"])
 
+  // Secrets and Admin are a superuser's: anyone else would open them onto a
+  // permission error.
   const withAdmin = currentUser?.is_superuser
     ? [...baseItems, { icon: Users, title: "Admin", path: "/admin" }]
-    : baseItems
+    : baseItems.filter((item) => item.path !== "/secrets")
 
   // Reached through a portal, the way out is back to the instances list —
   // and the session belongs to the portal, so logging out is its business.