Introduce cms_admin role, drop generic admin; add author-name editing

[nervesparksdev08]

• Replaces the generic admin role with a single cms_admin role across the CMS backend — role == "admin" checks in core/deps.py and app/routers/blogs.py (cross-tenant view/delete/update/draft checks) now check cms_admin, and the Literal["user", "admin"] role enum in app/models/schemas.py is updated to match.
• Adds PUT/POST /admin/blogs/{blog_id}/author — lets a cms_admin set or clear (nullable) a blog's author_name, independent of category management.

Why
Company wants a narrower "content approver" role that can only review/approve/manage blogs, distinct from a full platform admin. author_name needed to be admin-editable and nullable to support blogs migrated/reassigned between tenants without a hard author binding.

Test plan

• Confirm a cms_admin JWT can hit /admin/blogs/pending, /published, /approve, /reject, /blogs/{id}/author.
• Confirm a plain user role gets 403 on all admin/* routes and blog cross-tenant actions.
• Set an author name, clear it (empty string → null in DB), verify persists.