All admin endpoints require a session JWT with the `is_admin` claim (the role is verified server-side) and answer `403 FORBIDDEN` otherwise.

## Endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/admin/stats` | Platform totals (users, revenue, calls). |
| GET | `/admin/users` | Paginated users (filter by `status`). |
| GET | `/admin/users/:id` | User detail with keys, invoices and usage. |
| PATCH | `/admin/users/:id` | Update a user's status. |
| PATCH | `/admin/users/bulk` | Bulk update (max 100, skips self). |
| GET | `/admin/keys` | Paginated API keys. |
| DELETE | `/admin/keys/:id` | Revoke a key. |
| GET | `/admin/invoices` | Paginated top-up invoices with failure reasons. |
| GET | `/admin/traffic` | Traffic by product, day, and endpoint. |
| POST | `/admin/deploy-frontend` | Trigger a GitHub Actions deploy. |

## Errors

- `UNAUTHORIZED` (401): missing or invalid token.
- `FORBIDDEN` (403): non-admin caller.