Cleanup: remove dead auth middleware and fix security log leak

- Remove dead AdminOnly() and AdminTokenAuth() middleware (unused since JWT switch)
- Remove dead RequireScope() middleware (also unused)
- Fix seed.go: only log password when auto-generated (was logging every time)
- Fix seed.go: use admin.Username (normalized) instead of raw username in log
- Simplify generateRandomPassword: 12 bytes (24 hex chars) instead of 24 bytes then truncate
- Me handler: use claims.Subject (UUID) for lookup instead of username
- Remove unused /logout endpoint (stateless JWT)

internal/api/router.go

@@ -104,7 +104,6 @@ func New(cfg *config.Config, db *gorm.DB, llamaManager *llama.Manager) *gin.Engi
 	// Admin API v1 (JWT session auth)
 	adminV1 := v1.Group("/admin")
 	adminV1.POST("/login", adminLoginHandler.Login)
-	adminV1.POST("/logout", adminLoginHandler.Logout)
 	adminSession := adminV1.Group("")
 	adminSession.Use(middleware.AdminSessionAuth(adminJWTService))
 	adminSession.GET("/me", adminMeHandler.Me)