security: rate limit admin authentication

apps/api/app/main.py

@@ -19,6 +19,7 @@ from sqlalchemy import func, select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session, joinedload
 
+from .admin_security import verify_admin
 from .config import settings
 from .dependencies import Db
 from .community_review import ExternalReviewError, map_observation, publish_observation, reject_observation, suggest_aliases
@@ -105,11 +106,8 @@ app.include_router(activity_router)
 app.include_router(public_data_router)
 
 
-def _admin(authorization: Annotated[str | None, Header()] = None) -> str:
-    expected = f"Bearer {settings.admin_token}"
-    if not authorization or not hmac.compare_digest(authorization, expected):
-        raise HTTPException(status_code=401, detail="invalid admin token", headers={"WWW-Authenticate": "Bearer"})
-    return "admin"
+def _admin(request: Request, db: Db, authorization: Annotated[str | None, Header()] = None) -> str:
+    return verify_admin(request, db, authorization, settings)
 
 
 @app.get("/api/v1/admin/diagnostics")