Replace Unix socket admin API with authenticated HTTP admin API (ADR-028)

Remove src/admin/socket.rs and replace with Bearer token HTTP auth on the
health check listener (port 9900). New src/admin/auth.rs provides SHA-256
key hashing with constant-time comparison; src/admin/handler.rs implements
/admin/reload, /admin/status, and /admin/rotate-key. Admin endpoints return
404 when disabled (empty admin_key_path), 401 on bad auth. Config field
renamed admin_socket_path → admin_key_path. Deployment files updated for
key file mount instead of socket directory.

Cargo.toml

@@ -39,6 +39,10 @@ futures = "=0.3.31"
 dashmap = "=6.1"
 serde_json = "=1.0.140"
 sd-notify = "=0.4"
+subtle = "2"
+sha2 = "0.10"
+rand = "0.9"
+hex = "0.4"
 
 [dev-dependencies]
 rcgen = "=0.13"