Adds BACKEND_ADMIN_TOKEN env var (set in Doppler) as a required Bearer token for every admin route. Also fixes PocketBase filter injection in notification queries and wires BACKEND_ADMIN_TOKEN through docker-compose to both backend and ui services. Includes CLAUDE.md for AI assistant guidance. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>