fix: secure admin rate-limit endpoints with auth in all environments (#369)

[davidsoniaudin2-oss]

Summary

Fixes #369 - [MEDIUM] Unauthenticated Metrics Endpoint Exposes System Internals in Development Mode

Changes

Problem

Two admin endpoints (/api/v1/admin/rate-limit/metrics and /api/v1/admin/rate-limit/config) exposed detailed operational metrics. In development mode, the auth check was skipped entirely via NODE_ENV !== 'production' bypass, allowing attackers to map the API's rate limiting landscape and calibrate attacks.

Solution

• Removed the NODE_ENV !== 'production' bypass — endpoints now require authentication in ALL environments
• Applied stellarAuth.authenticate middleware to the admin routes
• Implemented role-based access control — only users with admin:access permission can access these endpoints (403 for non-admin users)
• Added DEV_ADMIN_TOKEN env var — configurable development admin token for local convenience (never hardcoded, only in non-production)
• Extracted admin routes into backend/src/routes/admin.ts for clean code organization and testability

Files Changed

File	Change
backend/src/index.ts	Replaced inline admin endpoints with app.use("/api/v1/admin", adminRoutes)
backend/src/routes/admin.ts	New — Admin routes with adminAuth middleware
backend/src/config/env.ts	Added DEV_ADMIN_TOKEN to env schema
backend/src/__tests__/admin-rate-limit.test.ts	New — 14 comprehensive tests

Test Coverage

• ✅ Unauthenticated → 401 in ALL environments (dev, test, production)
• ✅ Non-admin user → 403 in ALL environments
• ✅ Admin user → 200 with full metrics/config
• ✅ Dev admin token → 200 in non-production
• ✅ Invalid dev token → 401
• ✅ Dev token rejection in production → 401

Acceptance Criteria Checklist

• Remove NODE_ENV !== 'production' bypass — auth required in ALL environments
• Apply stellarAuth.authenticate to admin routes
• Role-based access: only admin users can access
• Configurable DEV_ADMIN_TOKEN via env var
• Tests: unauthenticated → 401, non-admin → 403, admin → 200
  closes [MEDIUM] Unauthenticated Metrics Endpoint Exposes System Internals in Development Mode #369