Fix #949: Remove plaintext password fallback, add rate limiting on admin login

[munazzaghazali7-hash]

Fixes #949

Summary

api/controllers/adminController.js previously fell back to a plain
password === ADMIN_PASSWORD string comparison if ADMIN_PASSWORD wasn't
a bcrypt hash. Combined with no rate limiting on the login endpoint, this
meant a misconfigured (plaintext) admin password could be brute-forced
with unlimited attempts.

Changes

• api/controllers/adminController.js: Removed the plaintext fallback
  entirely. If ADMIN_PASSWORD isn't a valid bcrypt hash, login now fails
  closed (500) with a clear log message telling the operator how to
  generate a proper hash, instead of silently comparing in plaintext.
• api/middlewares/adminLoginLimiter.js (new): Adds rate limiting
  (10 attempts / 15 min per IP) on the admin login route using
  express-rate-limit, which was already a dependency but not wired up.
• api/routes/adminRoutes.js: Applies the new rate limiter to
  POST /login.

Breaking change

If an existing deployment has ADMIN_PASSWORD set as plaintext, admin
login will now fail with a 500 until it's replaced with a bcrypt hash.
This is intentional — plaintext admin passwords should not be supported.
To generate a hash:

```
node -e "console.log(require('bcryptjs').hashSync(process.argv[1], 12))" yourPassword
```

Testing

• Verified login succeeds with a valid bcrypt-hashed ADMIN_PASSWORD.
• Verified login fails closed (500) when ADMIN_PASSWORD is plaintext.
• Verified repeated failed login attempts are throttled after 10 tries.

[vercel]

@munazzaghazali7-hash is attempting to deploy a commit to the adithyansubramani1-1657's projects Team on Vercel.

A member of the Team first needs to authorize it.