added Admin Token for some Endpoints. Moved some Endpoints to /api/admin. Added a Notification Test Endpoint

README.md

@@ -25,6 +25,8 @@ Copy `.env.example` to `.env` and set the Apprise host, ntfy host/topic, and Dis
 
 The service posts a JSON payload to Apprise `/notify` with both the ntfy and Discord URLs. Apprise supports multiple destination URLs in one request. [Apprise API](https://github.com/caronc/apprise-api/blob/master/README.md)
 
+Set `ADMIN_TOKEN` to a long random secret to enable the protected admin endpoints. Authenticate with an `Authorization: Bearer <token>` header. If the header is absent, `?token=<token>` is also accepted. A present but invalid header is rejected without falling back to the query parameter. Query parameters may be recorded in browser history and server/proxy logs, so the header is preferred. If `ADMIN_TOKEN` is unset, admin endpoints return `503`.
+
 A `.env` file is optional at startup; without one, the server still runs, but notification sends will remain queued until the notification settings are configured. `PORT` defaults to `3000`; `DB_PATH` defaults to `./data/events.sqlite`.
 
 For production, run `npm run build` followed by `npm start`, and keep the process running with your preferred process manager or service host.
@@ -54,5 +56,14 @@ docker run -d --name 77th-ev-cal-ntfy-srv --restart unless-stopped \
 
 - `GET /health` — service and polling status
 - `GET /api/events` — latest active events and polling status
-- `POST /api/refresh` — trigger an immediate poll
+- `POST /api/admin/refresh` — trigger an immediate poll (Bearer token required)
+- `POST /api/admin/notifications/test` — send a test notification to ntfy and Discord (Bearer token required)
 - `GET /calendar.ics` — active events and cancellation entries for calendar subscription
+
+On startup, the service sends a notification to both ntfy and Discord. The test endpoint also sends to both configured destinations. If `notification_mock=true`, notifications are only logged and the test endpoint reports `mocked`.
+
+Example admin request:
+
+```sh
+curl -X POST -H "Authorization: Bearer $ADMIN_TOKEN" https://YOUR-HOST/api/admin/notifications/test
+```