fix: separate admin page and API authentication

deploy/Caddyfile

@@ -25,9 +25,8 @@
 
   @adminApi path /api/v1/admin/*
   handle @adminApi {
-    basic_auth {
-      {$ADMIN_BASIC_USER} {$ADMIN_BASIC_PASSWORD_HASH}
-    }
+    # FastAPI verifies the Bearer token. Basic Auth here would reject the
+    # browser's Bearer Authorization header before it reached the API.
     reverse_proxy api:8000
   }