feat(fb): add simple admin auth for form management endpoints

[DogukanUrker]

summary

we should add a minimal x-api-token check for form management endpoints when admin frontend work starts.

scope

• protect: POST /forms/, PUT /forms/{form_id}, DELETE /forms/{form_id}
• keep public: GET /forms/{id}, POST /submissions/, GET /health
• use same simple token style as user-service (no oauth/jwt)

context

we are intentionally deferring this until admin frontend implementation to keep current scope minimal.