Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)

Query strings leak into Traefik access logs, browser history, and Referer
headers. Admin key is now accepted only via X-Admin-Key; paste and can
passwords only via X-Paste-Password (or the POST unlock form). Tests
updated; new negative cases assert 401 for the query paths.

internal/api/main_test.go

@@ -89,7 +89,8 @@ func TestPasswordProtection(t *testing.T) {
 	}
 
 	// with password -> 200
-	req = httptest.NewRequest("GET", "/api/pastes/"+created.ID+"?password=hunter2", nil)
+	req = httptest.NewRequest("GET", "/api/pastes/"+created.ID, nil)
+	req.Header.Set("X-Paste-Password", "hunter2")
 	rec = httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	if rec.Code != 200 {
@@ -97,7 +98,8 @@ func TestPasswordProtection(t *testing.T) {
 	}
 
 	// wrong password -> 401
-	req = httptest.NewRequest("GET", "/api/pastes/"+created.ID+"?password=nope", nil)
+	req = httptest.NewRequest("GET", "/api/pastes/"+created.ID, nil)
+	req.Header.Set("X-Paste-Password", "nope")
 	rec = httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	if rec.Code != 401 {