feat: admin API endpoints for users, config, devices, and system monitoring (closes #11)

[Times-stack]

Closes #11

Summary

Implements the full admin API surface from the issue: user management,
protocol configuration, device management, and system monitoring, all
restricted to admin-role JWT holders.

Important: a dependency in the issue text is stale

The issue says these endpoints depend on auth middleware from "Issue
#5" — but #5 is actually about testing infrastructure (Mocha/Chai/
Supertest/mock blockchain), not auth. There's no real auth-providing
issue in this repo, and the codebase had zero authentication before
this PR.

Rather than block on a non-existent prerequisite, I built a small,
self-contained authenticate middleware (JWT verification only) —
just enough to satisfy #11's own verification steps (401 without a
token, 403 with a non-admin token). This is explicitly not a full
auth system — no login/register/refresh/password endpoints, no
persistent user credentials. It should be superseded by real
session/auth work whenever that lands; happy to adjust if a maintainer
points me to the actual auth issue I should have built against.

What changed

• src/middleware/auth.js: authenticate — verifies a Bearer JWT
  (JWT_SECRET env var), sets req.user from the payload.
• src/middleware/requireAdmin.js: checks req.user.roles
  includes admin, per the issue's spec.
• src/middleware/validate.js + src/schemas/admin.schema.js:
  Zod request validation. Issue [Security] Implement Input Validation with Zod Schemas and Request Sanitization #8's broader validation work hasn't
  landed separately, so schemas are scoped here to what these routes
  need.
• src/data/adminStore.js: in-memory storage for users, devices,
  and config (+ an audit log recording admin identity and timestamp
  per config change), per the issue's own allowance ("initially using
  in-memory storage, ready for database integration"). Structured so
  swapping in a real repository layer (issue [Refactor] Implement Repository Pattern for Clean Data Access Layer Abstraction #22, not yet landed)
  won't change the route handlers' public shape.
• src/lib/pagination.js: minimal pagination helper, since issue
  [Feature] Create Pagination, Filtering, and Search Utilities for All List Endpoints #17's pagination work hasn't landed either.
• src/routes/admin/{users,config,devices,system}.js +
  index.js: the full endpoint set —
  • Users: GET /, GET /:id, POST /, PATCH /:id, DELETE /:id
  • Config: GET /, PATCH /, POST /reset
  • Devices: POST /, GET /, PATCH /:id, DELETE /:id
  • System: GET /health, GET /stats, GET /ws-connections
    (reports a real count: 0 rather than fabricated data, since no
    WebSocket server exists in this codebase yet)
  • All routes carry @openapi JSDoc annotations, compatible with the
    swagger documentation work in the other open PR (#[swagger PR
    number]).
• index.js: mounts /api/admin behind authenticate +
  requireAdmin; added express.json() (wasn't present before, is
  needed for the new POST/PATCH bodies).
• test/admin.test.js: 18 tests using node:test (this repo's
  actual test convention — the issue suggests Mocha, but that isn't
  configured here) covering the issue's verification steps: 401/403
  auth guards, full user and device CRUD, config update + audit log +
  reset, and all three system endpoints.

Testing

This repo has no external service dependency, so I ran everything
locally: npm test passes 18/18, with no regressions on the existing
test.

[KarenZita01]

Failed CI. Fix it

[KarenZita01]

Can't merge with unresolved conflict and failed CI test. Try and fix it.

[Times-stack]

I will resolve it soon