feat(admin): add authenticated restart endpoint + fix admin username

- POST /api/v1/admin/restart: admin-only restart (forks new process)
- Fix: MemUserStore now uses cfg.AdminUsername instead of hardcoded 'admin'
- RestartFunc injected by main.go for clean process fork + exit

backend/cmd/cyrene/main.go

@@ -212,7 +212,7 @@ func main() {
 	log.Printf("[bridge] config store ready (path=%s, %d adapters)", bridgeCfgPath, bridgeStore.Count())
 
 	// === 12. Gateway ===
-	userStore := api.NewMemUserStore(cfg.AdminPassword)
+	userStore := api.NewMemUserStore(cfg.AdminUsername, cfg.AdminPassword)
 	authMgr := api.NewRealAuthManager(cfg.JWTSecret, cfg.JWTExpiryHours, userStore)
 
 	// Build dependencies for gateway handlers
@@ -254,6 +254,24 @@ func main() {
 	srv := &http.Server{Addr: addr, Handler: mainMux}
 
 	// === 13. Start ===
+	// Register restart handler — forks a new process and exits
+	api.RestartFunc = func() {
+		log.Printf("[gateway] restarting...")
+		reg.Shutdown()
+		srv.Close()
+		// Re-exec self with same args and env
+		exe, _ := os.Executable()
+		proc, err := os.StartProcess(exe, os.Args, &os.ProcAttr{
+			Env: os.Environ(),
+			Files: []*os.File{os.Stdin, os.Stdout, os.Stderr},
+		})
+		if err != nil {
+			log.Fatalf("[gateway] restart failed: %v", err)
+		}
+		log.Printf("[gateway] new process PID=%d, exiting...", proc.Pid)
+		os.Exit(0)
+	}
+
 	go func() {
 		log.Printf("[gateway] listening on %s", addr)
 		log.Printf("[gateway] plugins=%d tools=%d", reg.Count(), len(reg.GetAllToolDefinitions()))