Guard the admin API and pprof with a token only root and the server can read

The admin listener answered any local process: models added, nodes
upgraded, engine keys listed, the heap dumped. /api and /debug now demand
the token the server writes 0600 to its state directory on first start;
ctl, the console and node add send it (sudo, LLMGW_ADMIN_TOKEN or
--token-file). pprof is off unless debug_pprof. admin_listen off loopback
is refused unless admin_remote. Dashboard pages, /metrics and /health are
unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/cli/node.go

@@ -301,16 +301,21 @@ func (na *nodeAdd) runPlain(ctx context.Context, o onboard.Options, title string
 // this machine has it.
 func (na *nodeAdd) adminAPI() *ctlClient {
 	addr := na.admin
+	token := ""
+	cfg, err := config.Load(na.serverCfg)
+	if err == nil {
+		token = adminTokenPath(na.serverCfg, cfg)
+	}
 	if addr == "" {
 		addr = "127.0.0.1:9090"
-		if cfg, err := config.Load(na.serverCfg); err == nil && cfg.AdminListen != "" {
+		if err == nil && cfg.AdminListen != "" {
 			addr = cfg.AdminListen
 			if strings.HasPrefix(addr, ":") {
 				addr = "127.0.0.1" + addr
 			}
 		}
 	}
-	return newCtlClient(addr)
+	return newCtlClient(addr, token)
 }
 
 // errNoAdmin is the watch giving up because the admin API is not here, which