feat: enforce bearer token auth on all /api/admin/* endpoints

Adds BACKEND_ADMIN_TOKEN env var (set in Doppler) as a required Bearer
token for every admin route. Also fixes PocketBase filter injection in
notification queries and wires BACKEND_ADMIN_TOKEN through docker-compose
to both backend and ui services. Includes CLAUDE.md for AI assistant guidance.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/config/config.go

@@ -92,6 +92,10 @@ type LibreTranslate struct {
 type HTTP struct {
 	// Addr is the listen address, e.g. ":8080"
 	Addr string
+	// AdminToken is the bearer token required for all /api/admin/* endpoints.
+	// Set via BACKEND_ADMIN_TOKEN. When empty, admin endpoints are unprotected —
+	// only acceptable when the backend is unreachable from the public internet.
+	AdminToken string
 }
 
 // Meilisearch holds connection settings for the Meilisearch full-text search service.
@@ -242,7 +246,8 @@ func Load() Config {
 		},
 
 		HTTP: HTTP{
-			Addr: envOr("BACKEND_HTTP_ADDR", ":8080"),
+			Addr:       envOr("BACKEND_HTTP_ADDR", ":8080"),
+			AdminToken: envOr("BACKEND_ADMIN_TOKEN", ""),
 		},
 
 		Runner: Runner{