TokenRich Admin

Placeholder — admin UI not deployed yet. Keep private (CF Access / allowlist) once live.