feat(settings): add admin settings API routes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

app/lib/auth.server.ts

@@ -0,0 +1,6 @@
+export async function requireAdmin(request: Request) {
+  // Simple fallback: check x-admin-token header vs ADMIN_TOKEN
+  const token = request.headers.get('x-admin-token');
+  if (process.env.ADMIN_TOKEN && token === process.env.ADMIN_TOKEN) return;
+  throw new Response('Unauthorized', { status: 401 });
+}