Add public map with JWT admin login and protect admin APIs.

Keep map reads open; gate admin UI/nav and object mutations behind env-based admin credentials, and default parser batch limit to 10.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -12,6 +12,11 @@ TELEGRAM_SESSION_PATH=/data/telegram.session
 INTERNAL_TOKEN=dev-internal-token
 TEST_PI_API_KEY=test-pi-api-key-change-me
 
+# Admin UI login (public map stays open; /admin and object writes need JWT)
+ADMIN_USER=admin
+ADMIN_PASSWORD=change-me
+ADMIN_JWT_SECRET=change-me-jwt-secret
+
 # DeepSeek LLM:
 # - extract_mode=llm on CP workers (Telegram unstructured + Crawl4AI)
 # - Generate профиля парсера на ca-api (один раз; runtime — только правила)