feat(auth): token-based admin authentication for Playwright/CI (#105)

Add POST /api/auth/token — validates ADMIN_TOKEN env var, creates a 24h
session and sets the sid cookie so automated tools can access the admin
panel without Google OAuth. Admin login page gains a token input form.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/api/README.md

@@ -11,6 +11,7 @@ POST /api/auth/login                     → redirect to Google OAuth
 GET  /api/auth/callback                  OAuth return URL
 POST /api/auth/logout
 GET  /api/auth/session                   → { user? }
+POST /api/auth/token                     { token } → set sid cookie (ADMIN_TOKEN auth)
 
 GET  /api/integrations                   list connected integrations
 POST /api/integrations/todoist/connect   start Todoist OAuth
@@ -76,6 +77,7 @@ Sentry error capture is active when `SENTRY_DSN` is set.
 | `LOG_LEVEL` | `info` | pino log level |
 | `SENTRY_DSN` | `` | Sentry DSN; empty = Sentry disabled |
 | `VAPID_*` | | Web push keys |
+| `ADMIN_TOKEN` | `` | Static token for service/Playwright admin auth; empty = disabled |
 
 ## Health story