Admin improvements

[tonylee08]

Security

• Constant-time token comparison - Prevents timing attacks on bearer token validation using subtle::ConstantTimeEq
• Rate limiting on auth failures - 10 failed attempts/minute before returning 429, prevents brute-force attacks
• Protected tokens in memory - Tokens wrapped in secrecy::Secret, zeroed on drop, prevents accidental logging
• Audit logging - All admin actions logged with action type and key identifiers for traceability

Operational

• Health check unauthenticated - /admin/health moved outside auth layer for load balancer probes
• 404 on missing resources - delete_pool, delete_asset, and update_pool return 404 if resource doesn't exist
• Atomic pool updates - update_pool now executes single UPDATE query instead of up to 4 separate queries
• Startup warning - Logs warning if ADMIN_TOKENS env var is not configured