Separate admin key from client proxy API key (before phase-2 write endpoints) #10

Problem

/admin/state currently authenticates with the client proxy API key — the same key every /v1/* client uses. Anyone holding a client key can read pool state (account ids, request distribution, quota numbers).

Accepted for now (homelab, read-only endpoint, loopback bind), but must be fixed before phase 2 (write endpoints: drain, strategy switch, remove account) — a leaked client key must never allow mutating the proxy.

Design

• auth.adminApiKey (config + env ZCODE_PROXY_ADMIN_API_KEY), separate from auth.proxyApiKey
• Generate at first startup if absent (persisted to the config), displayed once
• /admin + /admin/state accept only the admin key
• Phase 2 write endpoints require the admin key + CSRF token (same-origin session)
• Rotation: changing the admin key must NOT invalidate client keys (and vice versa)

Also

• Client key was exposed in URLs during early dashboard testing (?key= flow, since removed). Rotate the client key when convenient.