Replace Unix socket admin API with authenticated HTTP admin API (ADR-028)

Remove src/admin/socket.rs and replace with Bearer token HTTP auth on the
health check listener (port 9900). New src/admin/auth.rs provides SHA-256
key hashing with constant-time comparison; src/admin/handler.rs implements
/admin/reload, /admin/status, and /admin/rotate-key. Admin endpoints return
404 when disabled (empty admin_key_path), 401 on bad auth. Config field
renamed admin_socket_path → admin_key_path. Deployment files updated for
key file mount instead of socket directory.

deploy/docker-compose.yml

@@ -10,7 +10,7 @@ services:
       - /etc/reverse-proxy/config.toml:/etc/reverse-proxy/config.toml:ro
       - /var/lib/reverse-proxy/acme-cache:/var/lib/reverse-proxy/acme-cache
       - /var/log/reverse-proxy:/var/log/reverse-proxy
-      - /run/reverse-proxy:/run/reverse-proxy
+      - /etc/reverse-proxy/admin-key:/etc/reverse-proxy/admin-key:ro
     networks:
       - proxy-net
     healthcheck: