Add timestamp-based expiration to admin API requests

[AbelOsaretin]

What

The Bearer token has no expiry mechanism. An intercepted token is valid forever. There is no way to revoke or time-limit access.

Why

If a token is leaked, it remains valid indefinitely. Adding request-level expiration limits the window of exposure.

Scope

• Add X-Request-Timestamp header requirement for admin requests
• Reject requests older than a configurable window (e.g., 5 minutes)
• Log rejected requests for security monitoring
• Make the window configurable via env var

Acceptance Criteria

• Admin requests without X-Request-Timestamp are rejected (or allowed with warning)
• Requests older than ADMIN_REQUEST_MAX_AGE_MS are rejected with 401
• Default window: 5 minutes
• Timestamp validation is timing-safe

Technical Context

• src/routes/admin.ts:9-16 — auth middleware
• New env var: ADMIN_REQUEST_MAX_AGE_MS (default: 300000)