Add ADMIN_TOKEN for admin endpoints and allow token-based auth

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/routers/runs.py

@@ -895,10 +895,23 @@ async def publish_run(
 
 @router.delete("/admin/purge-failed")
 async def purge_failed_runs(
-    ctx: UserContext = Depends(require_auth),
+    request: Request,
+    ctx: UserContext = Depends(get_current_user),
 ):
-    """Delete all failed runs from pending_runs table."""
+    """Delete all failed runs from pending_runs table.
+
+    Requires authentication OR admin token in X-Admin-Token header.
+    """
     import database
+    import os
+
+    # Check for admin token
+    admin_token = os.environ.get("ADMIN_TOKEN")
+    request_token = request.headers.get("X-Admin-Token")
+
+    # Require either valid auth or admin token
+    if not ctx and (not admin_token or request_token != admin_token):
+        raise HTTPException(401, "Authentication required")
 
     # Get all failed runs
     failed_runs = await database.list_pending_runs(status="failed")