Limpieza post-diagnóstico del 403 (checkOrigin resuelto)

- Elimina /api/whoami (endpoint diagnóstico temporal).
- Elimina bloque debug del 403 en /api/admin/prestamos/[id]/devolver.
- Bitácora con la causa raíz y el fix.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/pages/api/admin/prestamos/[id]/devolver.ts

@@ -5,12 +5,7 @@ const json = (body: unknown, status = 200) =>
 
 export const POST: APIRoute = async ({ params, locals }) => {
   if (!locals.user) return json({ error: 'no autenticado' }, 401);
-  if (locals.profile?.rol !== 'admin') {
-    return json({
-      error: 'no autorizado',
-      debug: { email: locals.user.email, profile_rol: locals.profile?.rol ?? null },
-    }, 403);
-  }
+  if (locals.profile?.rol !== 'admin') return json({ error: 'no autorizado' }, 403);
 
   const id = Number(params.id);
   if (!Number.isInteger(id) || id <= 0) return json({ error: 'id inválido' }, 400);

src/pages/api/whoami.ts

@@ -1,11 +0,0 @@
-import type { APIRoute } from 'astro';
-
-export const GET: APIRoute = async ({ locals }) => {
-  return new Response(
-    JSON.stringify({
-      user: locals.user ? { id: locals.user.id, email: locals.user.email } : null,
-      profile: locals.profile,
-    }, null, 2),
-    { headers: { 'content-type': 'application/json' } },
-  );
-};