[Admin Console] Phase 1: Admin Backend Foundation

[Ferryx349]

Will start with setting up the secure foundation for the admin console.

Tasks:

• Add admin.enabled (default: false) to settings.yaml and the Settings type
• Add a protected /admin Express router that returns 404 when admin is disabled
• Add a replaceable auth middleware (Bearer token for now, NIP-98 later)
• Add GET /admin/health endpoint
• Add GET /admin/session endpoint
• Write unit tests for disabled-by-default and auth behavior

Wil do this issue in a single PR.