fix: IDAA auth — harden novi_admin_li/trusted_li and remove iframe gate

- ae_idaa_stores.ts: update default novi_admin_li UUID; add staff UUID to
  novi_trusted_li hardcoded defaults.
- +layout.svelte (idaa): only overwrite admin/trusted lists from site_cfg_json
  when the list is non-empty, so hardcoded defaults are never silently cleared.
  Remove $ae_loc.iframe requirement for 'authenticated' access level — the
  presence of a valid Novi UUID in the URL is sufficient proof regardless of
  whether the iframe flag is set yet.

src/lib/stores/ae_idaa_stores.ts

@@ -23,10 +23,11 @@ const idaa_local_data_struct: key_val = {
     novi_uuid: null,
     novi_email: null,
     novi_full_name: null,
-    novi_admin_li: ['2b078deb-b4e7-4203-99da-9f7cd62159a5'],
+    novi_admin_li: ['2b078deb-b4e7-4203-99da-9f7cd62159a9'], // '2b078deb-b4e7-4203-99da-9f7cd62159a5'
     novi_trusted_li: [
         'c9ea07b5-06b0-4a43-a2d0-8d06558c8a82',
-        '58db22ee-4b0a-49a7-9f34-53d2ba85a84b'
+        '58db22ee-4b0a-49a7-9f34-53d2ba85a84b',
+        '2b078deb-b4e7-4203-99da-9f7cd62159a5',
     ],
     novi_jitsi_mod_li: ['5724aad7-6d89-47e7-8943-966fd22911bd'],