// Package admin exposes internal management endpoints: code-batch generation,
// node CRUD, user lookup/ban, and audit-log queries. The admin router is
// mounted on a separate listener (or sub-path) protected by IP allowlist
// and two-factor authentication — it is never exposed on the public API port.
package admin