Refactor admin procedures into separate files

Extract admin procedures from router.ts into dedicated files under
procedures/admin/ with consolidated exports via _routes.ts. Adds shared
helper functions for response transformation and includes race condition
fixes via transaction-scoped existence checks.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs/initial-app.md

@@ -76,6 +76,15 @@ publisher-dashboard/
 │   │       ├── index.ts           # Server entry point (Bun.serve)
 │   │       ├── router.ts
 │   │       ├── procedures/
+│   │       │   ├── base.ts        # Middleware (auth, superuser, loginRequest)
+│   │       │   ├── auth/          # Auth procedures
+│   │       │   ├── me/            # User self-management procedures
+│   │       │   └── admin/         # Superuser-only procedures
+│   │       │       ├── _routes.ts # Consolidated admin route exports
+│   │       │       ├── helpers.ts # Shared transform functions
+│   │       │       ├── auth/
+│   │       │       ├── orgs/
+│   │       │       └── users/
 │   │       └── middleware/
 │   ├── publisher-dashboard/       # SvelteKit frontend
 │   │   ├── package.json
@@ -2322,6 +2331,12 @@ _Can run parallel to J2-J6_
 - [x] **K4**: Implement `admin.orgs.addSite`, `admin.orgs.removeSite`
 - [x] **K5**: Implement `admin.auth.completeLogin` (dev helper)
 
+_Implementation notes:_
+- Files in `procedures/admin/` with `_routes.ts` for consolidated exports
+- Helper functions in `helpers.ts`: `toOrgResponse`, `toUserResponse`, `toSiteResponse`
+- Race conditions prevented via transaction-scoped existence checks
+- Self-demotion guard in `adminUsersUpdate` prevents superusers from removing their own status
+
 #### Workstream L: Org Pages (Frontend)
 
 _Depends on: J1-J6, C3_