fix: harden admin access, repair ORM joins, and add migration/tests

.env.example

@@ -11,6 +11,10 @@ SECRET_KEY=your-secret-key-here-change-in-production
 API_V1_STR=/api/v1
 PROJECT_NAME=IRT Bank Soal
 ENVIRONMENT=development
+ENABLE_ADMIN=false
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD=change-me
+ADMIN_SESSION_EXPIRE_SECONDS=3600
 
 # OpenRouter (AI Generation)
 OPENROUTER_API_KEY=your-openrouter-api-key-here