feat: admin API scope

[msmithstubbs]

Follows on from #3039

• private:admin scope is required to create, delete, or update a team
• private:admin scope is required for create, read, update, delete of backends

Need clarification on:

1. should /api/sources/:token/backends/:backend_token require admin scope?

[Ziinc]

should /api/sources/:token/backends/:backend_token require admin scope?

attaching sources to a backend doesn't need admin scope. fine to let users view the backends as readonly.