Replace token-based admin auth with JWT session authentication

- Add AdminUser model (bcrypt hashed passwords) and admin_users table
- Add AdminJWTService for HS256 JWT sessions (24h TTL)
- Add AdminSessionAuth middleware for /api/v1/admin/* routes
- Add admin handlers: login, logout, me, change-password, users CRUD
- Keys and model management routes now require admin JWT session
- Remove ADMIN_TOKEN, add ADMIN_USERNAME, ADMIN_PASSWORD env vars
- Update frontend: username/password login, admin_session storage, AdminUsers CRUD view

cmd/llamalink/main.go

@@ -52,9 +52,9 @@ func main() {
 	}
 	logger.Info("database migrations complete")
 
-	// Seed admin key if needed
-	if err := db.SeedAdminKey(database, cfg.AdminToken); err != nil {
-		logger.Error("failed to seed admin key", "error", err)
+	// Seed admin user if needed
+	if err := db.SeedAdminUser(database, cfg.AdminUsername, cfg.AdminPassword); err != nil {
+		logger.Error("failed to seed admin user", "error", err)
 		os.Exit(1)
 	}