fix: remove dead token=="" branch and add probeRR HTTP-layer test

adminBearerMiddleware had an unreachable branch (token == "") since admin
routes are only registered when a token is configured. Remove it to
eliminate dead code.

Add TestAdminCreateRecordInvalidMXValue to exercise the probeRR rejection
path at the HTTP layer (malformed MX value → 400).

Author: ZPascal

api.go

@@ -146,12 +146,6 @@ type adminRecordRequest struct {
 func adminBearerMiddleware(next httprouter.Handle) httprouter.Handle {
 	return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
 		token := Config.API.Admin.Token
-		if token == "" {
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusUnauthorized)
-			_, _ = w.Write(jsonError("unauthorized"))
-			return
-		}
 		auth := r.Header.Get("Authorization")
 		provided := strings.TrimPrefix(auth, "Bearer ")
 		if subtle.ConstantTimeCompare([]byte(token), []byte(provided)) != 1 {

api_test.go

@@ -616,6 +616,20 @@ func TestAdminCreateRecordInvalidValue(t *testing.T) {
 		Expect().Status(http.StatusBadRequest)
 }
 
+func TestAdminCreateRecordInvalidMXValue(t *testing.T) {
+	_, e := setupAdminRouter(t, "test-token")
+	payload := map[string]interface{}{
+		"name":  "test.example.com",
+		"type":  "MX",
+		"value": "not-a-valid-mx",
+		"ttl":   60,
+	}
+	e.POST("/admin/records").
+		WithHeader("Authorization", "Bearer test-token").
+		WithJSON(payload).
+		Expect().Status(http.StatusBadRequest)
+}
+
 func TestAdminListRecordsFilter(t *testing.T) {
 	_, e := setupAdminRouter(t, "test-token")
 	// Create an A record and a CNAME record