Harden admin authentication behind trusted proxy

app/api/internal.py

@@ -5,28 +5,16 @@ partials and external monitoring. They do not replace the current admin pages.
 """
 from __future__ import annotations
 
-from hmac import compare_digest
-
 from fastapi import APIRouter, Body, Depends, HTTPException, Request
 from sqlalchemy import text
 
-from app.config import is_production_like_env, settings
+from app.admin_auth import require_admin_auth
+from app.config import settings
 from app.db import engine
 
 def require_internal_access(request: Request) -> None:
-    expected = (settings.clientflow_admin_token or "").strip()
-    if not expected:
-        if is_production_like_env():
-            raise HTTPException(status_code=503, detail="internal api auth not configured")
-        return
-    received = (
-        request.headers.get("X-ClientFlow-Admin-Token")
-        or request.cookies.get("clientflow_admin_token")
-        or (request.query_params.get("admin_token") if not is_production_like_env() else None)
-        or ""
-    ).strip()
-    if not received or not compare_digest(received, expected):
-        raise HTTPException(status_code=401, detail="internal api auth required")
+    """Apply API auth (including X-ClientFlow-Admin-Token in token mode)."""
+    require_admin_auth(request, area="internal_api")
 
 
 router = APIRouter(prefix="/api/internal", tags=["internal"], dependencies=[Depends(require_internal_access)])