feat: admin login, delete items, and IP bans API

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_admin.py

@@ -0,0 +1,32 @@
+def test_admin_login_and_delete(client):
+    token = client.post("/api/admin/login", json={"password": "changeme"}).json()["token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    slug = client.post("/api/items", json={"body": "bye"}).json()["slug"]
+    items = client.get("/api/admin/items", headers=headers).json()["items"]
+    item_id = next(i["id"] for i in items if i["slug"] == slug)
+    assert client.delete(f"/api/admin/items/{item_id}", headers=headers).status_code == 200
+    assert client.get(f"/api/items/{slug}").status_code == 404
+
+
+def test_admin_login_rejects_bad_password(client):
+    r = client.post("/api/admin/login", json={"password": "wrong"})
+    assert r.status_code == 401
+
+
+def test_admin_requires_bearer(client):
+    assert client.get("/api/admin/items").status_code == 401
+    assert client.get("/api/admin/items", headers={"Authorization": "Bearer nope"}).status_code == 401
+
+
+def test_admin_ban_and_unban(client):
+    token = client.post("/api/admin/login", json={"password": "changeme"}).json()["token"]
+    headers = {"Authorization": f"Bearer {token}"}
+
+    r = client.post("/api/admin/bans", headers=headers, json={"ip": "1.2.3.4", "reason": "spam"})
+    assert r.status_code == 200
+    bans = client.get("/api/admin/bans", headers=headers).json()["bans"]
+    assert any(b["ip"] == "1.2.3.4" and b.get("reason") == "spam" for b in bans)
+
+    assert client.delete("/api/admin/bans/1.2.3.4", headers=headers).status_code == 200
+    bans_after = client.get("/api/admin/bans", headers=headers).json()["bans"]
+    assert all(b["ip"] != "1.2.3.4" for b in bans_after)