Admin-only API endpoints for search, context generation, and vault health. Internal route wiring with fail-closed auth.