feat: bootstrap admin auth, DB schema, and encrypted API keys

- Add Prisma schema for AdminUser, Source, Article, SearchRule, SearchRun,
  and encrypted ApiKey storage.
- Implement JWT session middleware and admin login/logout.
- Add AES-256-GCM encryption helpers for API keys.
- Seed default news sources and admin credentials.
- Create admin shell layout and login page.

prisma/seed.ts

@@ -0,0 +1,44 @@
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+
+async function main() {
+  const sources = [
+    { name: 'NewsAPI', apiCode: 'newsapi', baseUrl: 'https://newsapi.org', credibilityScore: 7 },
+    { name: 'GNews', apiCode: 'gnews', baseUrl: 'https://gnews.io', credibilityScore: 7 },
+    { name: 'NewsData', apiCode: 'newsdata', baseUrl: 'https://newsdata.io', credibilityScore: 7 },
+    { name: 'Web Search', apiCode: 'websearch', baseUrl: null, credibilityScore: 5 },
+    { name: 'Brave Search', apiCode: 'brave', baseUrl: 'https://search.brave.com', credibilityScore: 6 },
+  ];
+
+  for (const source of sources) {
+    await prisma.source.upsert({
+      where: { apiCode: source.apiCode },
+      update: {},
+      create: source,
+    });
+  }
+
+  const adminUsername = process.env.ADMIN_USERNAME || 'admin';
+  const adminPasswordHash = process.env.ADMIN_PASSWORD_HASH;
+
+  if (adminPasswordHash) {
+    await prisma.adminUser.upsert({
+      where: { username: adminUsername },
+      update: { passwordHash: adminPasswordHash },
+      create: { username: adminUsername, passwordHash: adminPasswordHash },
+    });
+    console.log(`Seeded admin user: ${adminUsername}`);
+  }
+
+  console.log('Seeded default sources.');
+}
+
+main()
+  .catch((e) => {
+    console.error(e);
+    process.exit(1);
+  })
+  .finally(async () => {
+    await prisma.$disconnect();
+  });