feat: enforce bearer token auth on all /api/admin/* endpoints

Adds BACKEND_ADMIN_TOKEN env var (set in Doppler) as a required Bearer
token for every admin route. Also fixes PocketBase filter injection in
notification queries and wires BACKEND_ADMIN_TOKEN through docker-compose
to both backend and ui services. Includes CLAUDE.md for AI assistant guidance.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/cmd/backend/main.go

@@ -177,6 +177,7 @@ func run() error {
 			DefaultVoice: cfg.Kokoro.DefaultVoice,
 			Version:      version,
 			Commit:       commit,
+			AdminToken:   cfg.HTTP.AdminToken,
 		},
 		backend.Dependencies{
 			BookReader:        store,