Document and harden the admin token flow for the rate-limit dashboard

[priscaenoch]

Problem

src/pages/RateLimitDashboard.tsx asks the user to paste an admin token into a text input, stores it in sessionStorage under admin_token, and sends it as Authorization: Bearer <token> to /api/admin/analytics/*. There is no documentation of where this token comes from, what it grants, or its lifetime, and the admin route is reachable by anyone who navigates to /admin/rate-limits.

What needs to be done

• Document, in the README, what the admin token is, how an operator obtains it, and what the admin dashboard exposes.
• Ensure the token is never logged and never placed in a URL/query string.
• Add explicit handling for expired/invalid tokens: clear the stored token and prompt again rather than leaving the dashboard in a broken state.
• Consider marking the input type="password" and adding a "clear token" control so a shared machine does not retain it.
• Coordinate with the backend on the expected auth scheme for these endpoints.

Files

• src/pages/RateLimitDashboard.tsx
• README.md

Acceptance deliverables

• The admin token flow is documented end to end.
• Invalid/expired tokens produce a clear prompt and the stale token is cleared.
• The token is not exposed in logs or URLs, and can be cleared from the UI.

Tests to pass

• Test: a 401 response clears the stored token and shows the token prompt.
• Test: the dashboard renders the prompt when no token is present.