Protected surface

Public leaderboard pages stay open. Admin actions do not.

This is intentionally separate from user auth. You only need a single admin token here to create servers, rotate ingest keys, and manage wipes.