feat(admin): add authenticated restart endpoint + fix admin username

- POST /api/v1/admin/restart: admin-only restart (forks new process)
- Fix: MemUserStore now uses cfg.AdminUsername instead of hardcoded 'admin'
- RestartFunc injected by main.go for clean process fork + exit

backend/services/gateway/api/auth.go

@@ -28,14 +28,16 @@ type MemUserStore struct {
 	users map[string]*UserRecord
 }
 
-// NewMemUserStore creates an in-memory user store with a default admin.
-func NewMemUserStore(adminPassword string) *MemUserStore {
+// NewMemUserStore creates an in-memory user store with the configured admin account.
+func NewMemUserStore(adminUsername, adminPassword string) *MemUserStore {
 	s := &MemUserStore{users: make(map[string]*UserRecord)}
 
 	hash, _ := auth.HashPassword(adminPassword)
-	s.users["admin"] = &UserRecord{
-		UserID: "admin", Username: "admin",
-		PasswordHash: hash, Role: "admin",
+	s.users[adminUsername] = &UserRecord{
+		UserID:       adminUsername,
+		Username:     adminUsername,
+		PasswordHash: hash,
+		Role:         "admin",
 	}
 	return s
 }

backend/services/gateway/api/router.go

@@ -136,6 +136,7 @@ func (r *Router) setupRoutes() {
 
 	// Admin
 	r.mux.HandleFunc("/api/v1/admin/dashboard", r.authMW(r.adminMW(r.adminDashboardHandler)))
+	r.mux.HandleFunc("/api/v1/admin/restart", r.authMW(r.adminMW(r.adminRestartHandler)))
 	r.mux.HandleFunc("/api/v1/admin/llm-calls", r.authMW(r.adminMW(r.llmCallsHandler)))
 	r.mux.HandleFunc("/api/v1/admin/system", r.authMW(r.adminMW(r.systemInfoHandler)))
 	r.mux.HandleFunc("/api/v1/admin/plugins", r.authMW(r.adminMW(r.pluginListHandler)))
@@ -417,6 +418,19 @@ func (r *Router) adminDashboardHandler(w http.ResponseWriter, _ *http.Request) {
 	})
 }
 
+// RestartFunc is injected by main.go — called to restart the process.
+var RestartFunc func()
+
+func (r *Router) adminRestartHandler(w http.ResponseWriter, _ *http.Request) {
+	writeJSON(w, 200, M{"restart": "ok", "message": "Cyrene is restarting..."})
+	go func() {
+		time.Sleep(200 * time.Millisecond) // Let the response flush
+		if RestartFunc != nil {
+			RestartFunc()
+		}
+	}()
+}
+
 // --- Admin extra handlers ---
 
 func (r *Router) llmCallsHandler(w http.ResponseWriter, req *http.Request) {
@@ -638,3 +652,4 @@ func (r *Router) userID(req *http.Request) string { return req.Header.Get("X-Use
 
 // Ensure unused imports don't cause issues
 
+// Debug: this will be overwritten