feat: elevated permissions / write-gating for VIP names

[mbradley]

Currently the vip tag triggers a warning before revoke or tag removal, but does not block the action. Admins should not be able to revoke or untag a VIP name without elevated authorization.

Part of #26.

[TheSeydiCharyyev]

I'd like to take this one. Before I start, could you clarify what "elevated authorization" should mean here?

A few options come to mind:

1. Re-enter admin password before revoke/untag a VIP
2. Second admin must confirm the action
3. A new role (e.g. super-admin) with higher permissions
4. 2FA or email confirmation

Which direction do you prefer? Or is there another approach you have in mind?

Also — does the admin UI already have an auth layer I should build on, or is it currently open to all logged-in admins?