Replace token-based admin auth with JWT session authentication

- Add AdminUser model (bcrypt hashed passwords) and admin_users table
- Add AdminJWTService for HS256 JWT sessions (24h TTL)
- Add AdminSessionAuth middleware for /api/v1/admin/* routes
- Add admin handlers: login, logout, me, change-password, users CRUD
- Keys and model management routes now require admin JWT session
- Remove ADMIN_TOKEN, add ADMIN_USERNAME, ADMIN_PASSWORD env vars
- Update frontend: username/password login, admin_session storage, AdminUsers CRUD view

internal/config/config_test.go

@@ -32,7 +32,8 @@ func TestLoad(t *testing.T) {
 func TestLoadEnvOverride(t *testing.T) {
 	t.Setenv("LLAMALINK_PORT", "9000")
 	t.Setenv("LLAMALINK_ENV", "production")
-	t.Setenv("ADMIN_TOKEN", "secret-token")
+	t.Setenv("ADMIN_USERNAME", "admin")
+	t.Setenv("ADMIN_PASSWORD", "secret-password")
 
 	cfg := Load()
 
@@ -44,8 +45,12 @@ func TestLoadEnvOverride(t *testing.T) {
 		t.Errorf("expected env production, got %s", cfg.LlamalinkEnv)
 	}
 
-	if cfg.AdminToken != "secret-token" {
-		t.Errorf("expected AdminToken secret-token, got %s", cfg.AdminToken)
+	if cfg.AdminUsername != "admin" {
+		t.Errorf("expected AdminUsername admin, got %s", cfg.AdminUsername)
+	}
+
+	if cfg.AdminPassword != "secret-password" {
+		t.Errorf("expected AdminPassword secret-password, got %s", cfg.AdminPassword)
 	}
 }