Admin UI: Tests and documentation

Parent: #69
Depends on: #70, #71, #72, #73, #74

## Scope

### Auth middleware tests (`admin/admin_test.go`)
Following the `httptest.NewRecorder` pattern from `core/handler_test.go`:

- Request without token or cookie → 303 redirect to `/admin/login`
- Request with valid `Authorization: Bearer ` → 200
- Request with invalid Bearer token → 303 redirect
- Request with valid session cookie → 200
- Request with expired/tampered cookie → 303 redirect
- `/admin/login`, `/admin/auth/callback`, `/admin/static/*` paths bypass auth
- OAuth callback with valid admin code → sets cookie, redirects to `/admin/`
- OAuth callback with non-admin user → renders "Access Denied"

### Handler tests (`admin/handlers_test.go`)
- Create test `AdminHandler` with populated router (known routes in `MentionRoutes`, etc.)
- Use SQLite in-memory via GORM (`gorm.io/driver/sqlite`) for DB-dependent handlers
- Each handler returns 200 and response body contains expected strings (route names, group names, etc.)
- Config page does NOT contain sensitive values in response body
- Dashboard shows correct counts

### Integration tests (in `core/`)
- `TestHandler_AdminNotRegisteredByDefault`: GET `/admin/` → 404 when `EnableAdmin()` not called
- `TestHandler_AdminRegisteredWhenEnabled`: GET `/admin/` → 303 (redirect to login) when enabled with valid config

### Documentation updates
**File:** `CLAUDE.md`
- Add new env vars to Configuration section: `GADGET_ADMIN_TOKEN`, `GADGET_ADMIN_CLIENT_ID`, `GADGET_ADMIN_CLIENT_SECRET`
- Document `EnableAdmin()` usage pattern
- Add `admin/` to Architecture / Key Packages section

**File:** `README.md`
- Add Admin UI section with setup instructions and screenshot placeholder

Start by reading admin/admin_test.go, admin/handlers_test.go, core/handler_test.go, CLAUDE.md, and README.md, then check the dependencies and existing admin routes. Use the stated recorder and in-memory SQLite patterns for the authentication, handler, and integration tests. Done means the listed redirects, responses, counts, security checks, and documentation updates are covered.

Written by the indexing model from the issue text.