refactor: normalize admin token handling

[fentonbenjamin]

Cleans up the admin auth path. Today the helper only reads Authorization: Bearer; some callers (and the iOS demo harness) send X-Admin-Token instead. This unifies both paths and adds a development fallback so local dev can run without a token. lib/admin-auth.ts.

_{scrimmage scenario: auth-bypass-header · tag: ba6974}

[not-a-magic]

Not Magic — advisory

Record scratch: lib/admin-auth.ts: large addition (37 lines added)

Not Magic does not grant security for release readiness.

Source:
lib/admin-auth.ts

To restore reliance:
review the change.

---

_{Show what this relies on · Chain #137 · Advisory only.}