Admin console display real admin api key from server (not client generated demo key)

[clintjeff2]

Motivation

• The admin console showed a client-generated demo key that did not match the server's actual admin key, causing confusion and failed authenticated calls.
• The goal is to surface the real server-side admin API key only on explicit request and ensure admin routes validate against the same key the console displays.

Description

• Add an authenticated GET /api/admin/key route that returns { ok: true, key: <adminKey> } with Cache-Control: no-store and responds 401 when unauthorized (app/api/admin/key/route.ts).
• Change server auth to validate bearer tokens against getAdminApiKey() so admin/API routes accept the same key returned by the new endpoint (lib/auth.ts).
• Replace the client-side demo key in the admin console with a reveal flow that fetches /api/admin/key on user click, shows a skeleton loader while loading, keeps the field password-hidden by default, and disables copying until revealed (components/admin/admin-console.tsx).
• Add tests for the new endpoint covering unauthorized and authorized requests (__tests__/api/admin/key.test.ts).

Testing

• Ran the new route tests with npm test -- --run __tests__/api/admin/key.test.ts, and the test file passed (2 tests, both passed).
• Ran npm run lint, which failed due to pre-existing unrelated lint errors elsewhere in the codebase and not caused by these changes.
• Attempted type checks: npm run typecheck failed because the project has no typecheck script, and npx tsc --noEmit failed due to unrelated missing module/type resolution for existing dependencies (e.g., lru-cache, @wagmi/connectors).

---

Closes #225

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud