Add public map with JWT admin login and protect admin APIs.

Keep map reads open; gate admin UI/nav and object mutations behind env-based admin credentials, and default parser batch limit to 10.

Co-authored-by: Cursor <cursoragent@cursor.com>

AGENTS.md

@@ -36,10 +36,19 @@ docker compose up --build cp-workers-web   # single worker rebuild
 
 Health: `curl http://localhost:8080/api/health`
 
+Admin auth (map is public; `/admin/*` needs JWT from `ADMIN_USER` / `ADMIN_PASSWORD`):
+
+```bash
+TOKEN=$(curl -s -X POST http://localhost:8080/admin/auth/login \
+  -H 'Content-Type: application/json' \
+  -d '{"username":"admin","password":"change-me"}' | jq -r .access_token)
+```
+
 Create Telegram parser:
 
 ```bash
 curl -X POST http://localhost:8080/admin/jobs \
+  -H "Authorization: Bearer $TOKEN" \
   -H 'Content-Type: application/json' \
   -d '{"source_type":"telegram","source_config":{"channel":"example","limit":50}}'
 ```