docs(www): update feature documentation for v2.16.1

Updated pages: configuration (adminAccessRoles), security (admin access control)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lane711

www/src/app/configuration/page.mdx

@@ -59,6 +59,9 @@ interface SonicJSConfig {
     afterAuth?: Middleware[]    // Run after authentication
   }
 
+  // Admin access control
+  adminAccessRoles?: string[]  // Roles that can access /admin (default: ['admin'])
+
   // App metadata
   version?: string         // Application version
   name?: string            // Application name
@@ -92,6 +95,21 @@ export default app
 
 </CodeGroup>
 
+### Admin Access Control
+
+By default, only users with the `admin` role can access the `/admin` panel. To allow additional roles, use `adminAccessRoles`:
+
+<CodeGroup title="Admin Access Roles">
+
+```typescript
+const app = createSonicJSApp({
+  // Allow both admin and editor roles to access the admin panel
+  adminAccessRoles: ['admin', 'editor']
+})
+```
+
+</CodeGroup>
+
 ### With Custom Routes
 
 <CodeGroup title="Custom Routes">

www/src/app/security/page.mdx

@@ -31,6 +31,8 @@ SonicJS enforces role-based permissions across all routes:
 | **Author** | Own content | Read only | — | — | — |
 | **Viewer** | Read only | Read only | — | — | — |
 
+- The entire `/admin` panel requires the `admin` role by default
+- Customizable via `adminAccessRoles` in `createSonicJSApp()` config
 - User management routes require `admin` role
 - Content CRUD requires `admin`, `editor`, or `author`
 - Collection schema changes require `admin`
@@ -140,6 +142,7 @@ All security audit data is available via authenticated admin API endpoints:
 
 | Version | Date | Changes |
 |---------|------|---------|
+| v2.16.1 | Apr 2026 | Admin panel restricted to admin role by default, configurable `adminAccessRoles` |
 | v2.16.0 | Apr 2026 | BruteForceDetector KV resilience, CSRF exempt path expansion, Authorization header bypass for API clients |
 | v2.9.0 | Apr 2026 | RBAC enforcement on all admin routes |
 | v2.8.3 | Mar 2026 | SQL injection fix, XSS fixes (reflected + stored), PBKDF2 hashing, CSRF protection, rate limiting, CORS restrictions, security headers, JWT secret to env var |