Add Phase 6: multi-server admin panel (server registry + settings)

Gate a new /api/admin/* route set (register/list/update/delete servers)
behind a single shared MCMAPPER_ADMIN_TOKEN header, and add a /admin
frontend page (Alpine) to unlock, register new servers, and edit
authMode/anonymousChatAllowed/waypointFormat per server — these columns
already existed but were only editable via direct DB edit until now.

Written test-first per the project's TDD workflow: admin.ts's domain
logic, the index.ts route wiring, and a new e2e/tests/admin.spec.ts
covering the token gate and register/edit/delete round trip through the
real browser UI.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015tKdPZt78zbPUZMXWzKEKt

api/.env.example

@@ -15,7 +15,14 @@ MINIO_USE_SSL=false
 MINIO_ACCESS_KEY=mcmapper
 MINIO_SECRET_KEY=changeme-set-in-untracked-env
 
-# Only read by `bun run seed` (see scripts/seed-server.ts) — Phase 6 replaces this with a real
-# admin registration API. Point the mod's MapperConfig#serverToken at the same value.
+# Only read by `bun run seed` (see scripts/seed-server.ts) — the admin panel's "register a new
+# server" form (MCMAPPER_ADMIN_TOKEN below) is now the real registration path; this script is
+# kept around as a fallback for scripted/headless setup.
 MCMAPPER_SEED_SERVER_NAME=dev-server
 MCMAPPER_SEED_SERVER_TOKEN=changeme
+
+# Gates every /api/admin/* route (server registry + settings — see api/src/admin.ts) behind a
+# single shared secret, checked via the X-MCMapper-Admin-Token header. Left unset here on
+# purpose: an unset token disables admin routes entirely (401) rather than defaulting to open.
+# Set a real value in an untracked `.env` next to this file, same as MINIO_SECRET_KEY above.
+MCMAPPER_ADMIN_TOKEN=