SAMPLE EVIDENCE for AR-02 (made-up app Tidyhaus; not a real review)

admin-refund/index.ts checks profiles.role = 'admin' for the caller on the server before acting.