Admin endpoint: ENV/file admin key, --reset-admin-key, settings API wired into ratelimit/max-bytes/default-expiry/burn-window (#40)

README.md

@@ -51,6 +51,21 @@ The SQLite database lives in the `/data` volume inside the container.
 | `PALETTE_DB` | `palette.db` | SQLite database path |
 | `PALETTE_MAX_TEXT` | `5242880` | Max paste size in bytes (5 MB) |
 | `PALETTE_MAX_ITEM` | `26214400` | Max can item size in bytes (25 MB) |
+| `PALETTE_ADMIN_KEY` | generated | Admin key; if unset a 32-char hex key is generated and persisted to `<db-dir>/admin-key` (0600) |
+
+### Admin
+
+`GET /admin` serves the admin page. Enter the admin key there — it is stored in
+`sessionStorage` (never a cookie) and sent as the `X-Admin-Key` header on
+`GET`/`POST /admin/api/settings`.
+
+The admin API reads/sets: rate-limit burst, rate-limit refill per minute, max
+content bytes, default expiry, custom URL reservation days, and the burn
+viewer window (minutes). All admin access attempts are logged.
+
+```bash
+./palette --reset-admin-key   # regenerate the admin key and print it
+```
 
 ## API