Admin: log in once, keep a session cookie instead of the key in the URL

The admin key used to stay in the URL fragment and was sent with every
request. Now the key is exchanged once for a server-side session:

- POST /api/admin/login {key} sets bingo_admin=<random token>
  (HttpOnly, Secure, SameSite=Strict, no Path so it is scoped to the
  admin API directory, also behind a subpath proxy)
- POST /api/admin/logout ends the session
- sessions live in memory as sha256(token) -> expiry, absolute lifetime
  ADMIN_SESSION_HOURS (default 8); restart logs everyone out
- /admin#k=KEY still works as a login link; the page strips the fragment
  from the URL and history before logging in, then shows plain /admin
- wrong key answers 401 after 500 ms; Bearer header still works for scripts
- COOKIE_SECURE=0 for plain-http testing only

Tests: 11 passing (login, cookie flags, logout, expiry, admin disabled).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FhHiznVwtQ55ZSguTBWrxn

bingo/.env.example

@@ -4,6 +4,9 @@
 # Пустой ключ = админка выключена.
 ADMIN_KEY=
 
+# Сколько часов действует вход в /admin (с момента входа, без продления). Перезапуск контейнера тоже завершает вход.
+ADMIN_SESSION_HOURS=8
+
 # Сезон
 TIMEZONE=Europe/Moscow      # в каком поясе карточка обнуляется в понедельник 00:00
 SEASON_START=2026-11-02     # первый день, когда отметки идут в батарейку