Document and verify auth on indexer admin analytics endpoints

[samuel2926i39-art]

Summary

Adds docs/ADMIN_AUTH.md documenting the admin bearer-token auth scheme used by every /api/admin/* route on the indexer — how ADMIN_SECRET is configured, its scope, expiry, and rotation — and indexer/test/api/admin-auth.test.js, which asserts every /api/admin/* route (including the four analytics routes the frontend rate-limit dashboard calls: rate-limit-hits, top-users, violation-heatmap, upgrade-recommendations) returns 401 for both a missing and an invalid token, and that a valid token succeeds on the analytics routes.

Context

indexer/src/admin/adminAuth.js already applies router.use(adminAuthMiddleware) to the whole admin router in indexer/src/routes/admin.js, so every route on it — including the four analytics routes — was already gated; there was no undocumented gap in enforcement. I also confirmed the Authorization header is never logged: the request logger in indexer/src/api.js doesn't log headers, and indexer/src/audit/auditLogger.js records only method, endpoint, status_code, ip, and user-agent. Given that, this PR is documentation + tests only — no source change was required to satisfy the issue's enforcement requirement.

One thing worth calling out: the auth model here is a single shared static secret (no per-token scope), so there's no case where a valid token is rejected for insufficient permission — the middleware only ever returns 401, never 403. I documented this explicitly in docs/ADMIN_AUTH.md rather than force an artificial 403 branch that doesn't correspond to real behavior.

Before / After

Before: admin auth enforcement was implied by the router wiring but undocumented, and untested.
After: documented in docs/ADMIN_AUTH.md, and covered by tests proving 401 on missing/invalid tokens across all 12 admin routes and a successful (!= 401) response with a valid token on the 4 analytics routes named in the issue.

Testing

Added indexer/test/api/admin-auth.test.js, following the existing indexer/test/api/*.test.js convention (Jest + supertest + startApi()/db.init() against a real Postgres test database via TEST_DATABASE_URL/DATABASE_URL), matching the pattern used by the other files in that directory (e.g. contract.test.js, api.test.js).

Caveat: I was not able to run this locally (no Postgres instance / npm ci in this environment, and the repo instructions asked me not to install dependencies), so I have not executed this test suite myself — please run it in CI/locally before merging. Separately, I noticed .github/workflows/ci.yml currently only runs the root-level npm test and has no job that installs indexer/'s dependencies or runs indexer/test/api/*.test.js at all (pre-existing gap, unrelated to this change) — worth a follow-up issue if indexer/ tests aren't meant to be run manually only.

Closes #22