fix: require bearer-token auth on all admin routes

[Taure]

Summary

• Every admin route shipped with security => false - ban, unban, grant-currency, economy mutation, and broadcast were callable unauthenticated. All /admin/api/* routes now require Authorization: Bearer <token> (ASOBI_ADMIN_TOKEN), verified with a constant-time digest compare.
• Fail-closed: unconfigured, empty, non-binary, or unsubstituted-placeholder tokens (${ detected) deny everything.
• The live-dashboard websocket authenticates in-protocol (first frame must be {"type":"auth","token":...}, 5s idle timeout closes 1008): nova applies no route security to ws upgrades and has no pre-upgrade rejection path (nova_ws_handler: no way to reject a ws upgrade with a proper status code novaframework/nova#394), and browsers cannot set ws headers.
• The distribution cookie is no longer hardcoded in the repo: vm.args.src now takes ${RELEASE_COOKIE} from the environment (this repo is public; a committed cookie is a known credential for the node that can ban players and grant currency).
• Drops the unused arizona_core/arizona_nova deps (upstream mirror gone, broke rebar3 get-deps).

Notes for deploy

• A release without ASOBI_ADMIN_TOKEN and RELEASE_COOKIE set fails closed: admin API 401s everything. There is no prod sys.config yet (rebar3 as prod release was already broken - missing prod_sys.config.src); whoever adds it should carry the same env-var pattern.
• cowlib 2.16.1 advisory (GHSA-g2wm-735q-3f56) has no upstream fix yet; not exposed by this surface (no Set-Cookie emission). Bump when a fixed release lands.

Testing

• 20 eunit tests (auth module + ws auth flow), fmt/xref/dialyzer/elp lint/eqwalize clean on touched modules.
• Reviewed by beam-security-reviewer and erlang-code-reviewer; all findings addressed (ws 500-vs-401 resolved via in-protocol auth, placeholder guard generalized, verify/verify_req duplication collapsed, dist cookie externalized).