Admin API key auth, account_too_new fixes, clear-all-users cache

- Add ADMIN_API_KEY to config; accept via X-Admin-Key or Bearer (constant-time compare)
- Never serve cached null for nostr_first_seen_at; admin clear-cache and override-age
- Add clearAllUsersCache() and POST /admin/users/clear-cache for all users
- Update .env.example with admin API key and pubkeys comments

Made-with: Cursor

backend/.env.example

@@ -58,7 +58,8 @@ DEPOSIT_LNURLP=https://yourdomain.com/.well-known/lnurlp/faucet
 BASE_SPONSOR_PRICE_PER_DAY=200
 SPONSOR_MAX_ACTIVE_PER_USER=5
 SPONSOR_MAX_VISIBLE=6
-# Comma-separated hex pubkeys for admin API
+# Admin API: shared secret or Nostr pubkeys
+# ADMIN_API_KEY=your-secure-random-key-min-32-chars
 # ADMIN_PUBKEYS=abc123...,def456...
 # Public API URL for LNbits webhook (e.g. https://api.example.com)
 # PUBLIC_API_URL=https://api.example.com