Replace token-based admin auth with JWT session authentication

- Add AdminUser model (bcrypt hashed passwords) and admin_users table
- Add AdminJWTService for HS256 JWT sessions (24h TTL)
- Add AdminSessionAuth middleware for /api/v1/admin/* routes
- Add admin handlers: login, logout, me, change-password, users CRUD
- Keys and model management routes now require admin JWT session
- Remove ADMIN_TOKEN, add ADMIN_USERNAME, ADMIN_PASSWORD env vars
- Update frontend: username/password login, admin_session storage, AdminUsers CRUD view

internal/api/handlers/keys.go

@@ -6,7 +6,6 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 
-	"github.com/llamalink/llamalink/internal/api/middleware"
 	"github.com/llamalink/llamalink/internal/auth"
 )
 
@@ -97,18 +96,6 @@ func (h *KeysHandler) RevokeKey(c *gin.Context) {
 		return
 	}
 
-	// Can't revoke own key
-	currentKey := middleware.GetAPIKey(c)
-	if currentKey.ID == id {
-		c.JSON(http.StatusBadRequest, gin.H{
-			"error": gin.H{
-				"code":    "validation_error",
-				"message": "Cannot revoke your own admin key",
-			},
-		})
-		return
-	}
-
 	if err := h.authService.Revoke(id); err != nil {
 		if err == auth.ErrKeyNotFound {
 			c.JSON(http.StatusNotFound, gin.H{"error": "key not found"})