MVP admin panel. Protected by a simple token (set ADMIN_TOKEN in your env). Replace with proper auth later (Clerk/Auth0/NextAuth).