security: Add simple API key verification for protected routes

[AlAfiz]

Description

Certain backend routes (like triggering manual database syncs in the future) should only be accessible to authorized clients. We need a simple header check.

Requirements

• Add an ADMIN_API_KEY to the .env file.
• Create a middleware function verifyApiKey.
• Check if req.headers['x-api-key'] matches the environment variable.
• If it doesn't match, return a 401 Unauthorized.