fix(router): remove AdminAuth from test-token — unblocks E2E CI bootstrap

[HongmingWang-Rabbit]

Summary

Reverts the AdminAuth gate on GET /admin/workspaces/:id/test-token that #612 added. This endpoint is the bootstrap path for E2E tests and fresh installs to obtain their first admin bearer token. With AdminAuth, it's a chicken-and-egg deadlock:

1. POST /workspaces (fail-open, no tokens) → creates workspace → token inserted in DB
2. AdminAuth now sees a live token → requires auth on ALL routes
3. E2E calls test-token to get first bearer → 401 "admin auth required"
4. All subsequent tests fail

The handler's own guard (TestTokensEnabled() == false when MOLECULE_ENV=prod) is the correct production gate. AdminAuth was defence-in-depth that broke the only bootstrap path.

Impact

This has been blocking ALL open PR CI for 6+ maintenance cycles. Combined with the migration 028 FK bug (fixed in #670), these two issues explain why the team's PRs have been stuck despite active development.

Timeline of CI blockers this session:

1. Migration 028 TEXT→UUID FK — fixed by fix(migrations): TEXT→UUID in 028_workspace_artifacts — unblocks all E2E CI #670 (merged ~10:17 UTC)
2. This bug — fix(security): gate test-token endpoint behind AdminAuth #612's AdminAuth on test-token (introduced ~21:15 UTC yesterday, masked by the migration failure until fix(migrations): TEXT→UUID in 028_workspace_artifacts — unblocks all E2E CI #670 landed)

Test plan

• Confirmed root cause via CI logs: test-token response: {"error":"admin auth required"}
• CI on this PR should be the first to pass E2E since the 028 fix
• After merge + rebase, feat(infra): Slack CI/build-break notifications for DevOps (#624) #650/feat: molecule-audit-ledger — HMAC-SHA256 immutable agent event log (#594) #651/fix(security): metrics auth, token revocation hardening, A2A false-negative (#682 #683 #689) #696/fix(security): input validation, route auth, UUID safety (#685 #686 #687 #688) #701 should all go GREEN

🤖 Generated with Claude Code