feat: admin API

[pthmas]

Wire up ADMIN_API_KEY (currently documented but unused) and add protected endpoints. A single key configured via env var is used for all admin routes — rotated by updating the env and restarting.

• Auth — Authorization: Bearer <ADMIN_API_KEY> middleware on all /api/admin/* routes
• Contract verification — POST /api/admin/contracts/:address/verify (source + compiler metadata → upsert contract_abis)
• Address labels — PUT/DELETE /api/admin/labels/:address (table already exists, just needs endpoints)