Keep the admin surface local while serving tiles on the LAN

Binding to 0.0.0.0 used to demand credentials because the admin console and
the tile routes shared one listener. That forced a choice between keeping the
console off the network and letting other machines fetch tiles.

Admin routes are now loopback-only by default: the service can bind 0.0.0.0 so
/tiles, /vectors, the catalog and the probes reach the LAN, while /admin and
/api/v1/admin answer 403 to anything arriving from another host. Credentials
are only required when ADMIN_ALLOW_REMOTE=true actually opens the console up,
which is the case worth guarding.

Tests cover both sides: a remote admin request is refused, a remote tile
request still reaches the token check.

services/api-go/cmd/api/main.go

@@ -87,7 +87,7 @@ func run(ctx context.Context) error {
 
 	// The admin surface can create tokens that read every basemap, so it must
 	// never be reachable off-host without credentials.
-	if cfg.BindsToNonLoopback() && !cfg.HasAdminCredentials() {
+	if cfg.BindsToNonLoopback() && cfg.AdminAllowRemote && !cfg.HasAdminCredentials() {
 		return fmt.Errorf("refusing to listen on %s without admin credentials: set ADMIN_TOKEN or ADMIN_USER/ADMIN_PASSWORD", cfg.ListenAddr())
 	}
 
@@ -149,9 +149,10 @@ func run(ctx context.Context) error {
 
 	server, err := basemapapi.New(store, systemInfo, basemapapi.Options{
 		Admin: basemapapi.AdminAuth{
-			Token:    cfg.AdminToken,
-			User:     cfg.AdminUser,
-			Password: cfg.AdminPassword,
+			Token:       cfg.AdminToken,
+			User:        cfg.AdminUser,
+			Password:    cfg.AdminPassword,
+			AllowRemote: cfg.AdminAllowRemote,
 		},
 		CORSAllowedOrigins: cfg.CORSAllowedOrigins,
 	})