feat: add org admin authentication

[shreyanshjain7174]

Summary

• Add organization and admin persistence with bcrypt password hashes.
• Add optional first-admin bootstrap for self-hosted instances.
• Add encrypted, purpose-separated admin sessions with login and logout routes.
• Preserve the existing X-Admin-Secret path.
• Require a same-origin custom header for session-authenticated writes.

Validation

• docker compose config --quiet
• go build ./...
• go test ./...
• Security review covered CSRF, session key separation, rate limits, bootstrap races, and password length.