Replace token-based admin auth with JWT session authentication

- Add AdminUser model (bcrypt hashed passwords) and admin_users table
- Add AdminJWTService for HS256 JWT sessions (24h TTL)
- Add AdminSessionAuth middleware for /api/v1/admin/* routes
- Add admin handlers: login, logout, me, change-password, users CRUD
- Keys and model management routes now require admin JWT session
- Remove ADMIN_TOKEN, add ADMIN_USERNAME, ADMIN_PASSWORD env vars
- Update frontend: username/password login, admin_session storage, AdminUsers CRUD view

internal/api/router.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/llamalink/llamalink/internal/api/handlers"
+	"github.com/llamalink/llamalink/internal/api/handlers/admin"
 	"github.com/llamalink/llamalink/internal/api/middleware"
 	"github.com/llamalink/llamalink/internal/auth"
 	"github.com/llamalink/llamalink/internal/config"
@@ -30,6 +31,7 @@ func New(cfg *config.Config, db *gorm.DB, llamaManager *llama.Manager) *gin.Engi
 	quotaSvc := quota.NewService(db)
 	webhookSvc := quota.NewWebhookService(db)
 	proxy := llama.NewProxy(llamaManager)
+	adminJWTService := auth.NewAdminJWTService(cfg.JWTSecret, cfg.AdminSessionTTL)
 
 	// Initialize handlers
 	healthHandler := handlers.NewHealthHandler(db, llamaManager)
@@ -37,6 +39,9 @@ func New(cfg *config.Config, db *gorm.DB, llamaManager *llama.Manager) *gin.Engi
 	keysHandler := handlers.NewKeysHandler(authService)
 	modelsHandler := handlers.NewModelsHandler(llamaManager)
 	usageHandler := handlers.NewUsageHandler(db, quotaSvc)
+	adminLoginHandler := admin.NewLoginHandler(db, adminJWTService)
+	adminMeHandler := admin.NewMeHandler(db)
+	adminUsersHandler := admin.NewUsersHandler(db)
 
 	// Health endpoints (public)
 	r.GET("/health", healthHandler.Health)
@@ -50,10 +55,9 @@ func New(cfg *config.Config, db *gorm.DB, llamaManager *llama.Manager) *gin.Engi
 	chat.Use(middleware.APIKeyAuth(authService))
 	chat.POST("/completions", chatHandler.ChatCompletions)
 
-	// Keys management (admin only)
+	// Keys management (admin session required)
 	keys := v1.Group("/keys")
-	keys.Use(middleware.APIKeyAuth(authService))
-	keys.Use(middleware.AdminOnly())
+	keys.Use(middleware.AdminSessionAuth(adminJWTService))
 	keys.GET("", keysHandler.ListKeys)
 	keys.POST("", keysHandler.CreateKey)
 	keys.DELETE("/:id", keysHandler.RevokeKey)
@@ -66,10 +70,9 @@ func New(cfg *config.Config, db *gorm.DB, llamaManager *llama.Manager) *gin.Engi
 	models.GET("/active", modelsHandler.GetActiveModel)
 	models.GET("/:name", modelsHandler.GetActiveModel) // alias for compatibility
 
-	// Model load (admin only)
+	// Model load (admin session required)
 	modelLoad := v1.Group("/models")
-	modelLoad.Use(middleware.APIKeyAuth(authService))
-	modelLoad.Use(middleware.AdminOnly())
+	modelLoad.Use(middleware.AdminSessionAuth(adminJWTService))
 	modelLoad.POST("/:name/load", modelsHandler.LoadModel)
 
 	// Usage (requires API key auth)
@@ -110,5 +113,18 @@ func New(cfg *config.Config, db *gorm.DB, llamaManager *llama.Manager) *gin.Engi
 		c.Data(http.StatusOK, "text/html; charset=utf-8", index)
 	})
 
+	// Admin API v1 (JWT session auth)
+	adminV1 := v1.Group("/admin")
+	adminV1.POST("/login", adminLoginHandler.Login)
+	adminV1.POST("/logout", adminLoginHandler.Logout)
+	adminSession := adminV1.Group("")
+	adminSession.Use(middleware.AdminSessionAuth(adminJWTService))
+	adminSession.GET("/me", adminMeHandler.Me)
+	adminSession.POST("/change-password", adminMeHandler.ChangePassword)
+	adminSession.GET("/users", adminUsersHandler.List)
+	adminSession.POST("/users", adminUsersHandler.Create)
+	adminSession.PUT("/users/:id", adminUsersHandler.Update)
+	adminSession.DELETE("/users/:id", adminUsersHandler.Delete)
+
 	return r
 }