feat: add internal cluster admin endpoints

platform/config/config.go

@@ -23,6 +23,7 @@ type Config struct {
 	RedisAddr         string
 	AppSiteURL        string
 	MasterKeyBase64   string
+	OperatorToken     string
 }
 
 func Load() (Config, error) {
@@ -54,6 +55,7 @@ func Load() (Config, error) {
 		RedisAddr:         getenv("REDIS_ADDR", "localhost:6379"),
 		AppSiteURL:        getenv("APP_SITE_URL", "http://localhost:5173"),
 		MasterKeyBase64:   os.Getenv("MASTER_KEY_BASE64"),
+		OperatorToken:     os.Getenv("OPERATOR_TOKEN"),
 	}, nil
 }
 

platform/config/config_test.go

@@ -43,6 +43,7 @@ func TestLoadOverrides(t *testing.T) {
 	t.Setenv("WORKER_CONCURRENCY", "12")
 	t.Setenv("REDIS_ADDR", "redis:6379")
 	t.Setenv("MASTER_KEY_BASE64", "test-key")
+	t.Setenv("OPERATOR_TOKEN", "operator-secret")
 
 	cfg, err := Load()
 	if err != nil {
@@ -70,6 +71,9 @@ func TestLoadOverrides(t *testing.T) {
 	if cfg.MasterKeyBase64 != "test-key" {
 		t.Fatalf("MasterKeyBase64 = %q, want test-key", cfg.MasterKeyBase64)
 	}
+	if cfg.OperatorToken != "operator-secret" {
+		t.Fatalf("OperatorToken = %q, want operator-secret", cfg.OperatorToken)
+	}
 }
 
 func TestLoadRejectsInvalidLogLevel(t *testing.T) {
@@ -110,6 +114,7 @@ func clearConfigEnv(t *testing.T) {
 		"REDIS_ADDR",
 		"APP_SITE_URL",
 		"MASTER_KEY_BASE64",
+		"OPERATOR_TOKEN",
 	} {
 		t.Setenv(key, "")
 	}