Implement RBAC for admin API

## Description
Replace static token with role-based access control.

## Tasks
- Define roles (admin, analyst)
- Add permission checks
- Secure endpoints

## Difficulty
Advanced

## Impact
Critical for SaaS readiness.