Add role-based access control for admin vs IoT endpoints

[AbelOsaretin]

What

All /api/admin routes share a single Bearer token check. Different admin actions (read scores vs. write scores) have the same permission level. IoT endpoints have no auth at all.

Why

The principle of least privilege is violated. A read-only admin should not be able to trigger on-chain transactions. IoT endpoints may need auth in the future.

Scope

• Define roles: admin:read, admin:write, iot:read
• Support multiple API keys with different roles (comma-separated or JSON)
• Enforce role checks per route
• Document the role system

Acceptance Criteria

• ADMIN_API_KEY supports role syntax (e.g., key:admin:write)
• Read-only admin key cannot trigger score updates
• IoT endpoints can be optionally auth-protected
• Role checks return 403 (Forbidden) for insufficient permissions
• Documentation updated

Technical Context

• src/routes/admin.ts:9-16 — current single-key auth
• src/routes/iot.ts — no auth middleware
• Env var format: ADMIN_API_KEY=key:admin:write or ADMIN_API_KEYS=key1:read,key2:write