Validate admin key on register

API.md

@@ -7,7 +7,7 @@ POST /api/auth/register
 POST /api/auth/login  
 POST /api/auth/logout
 
-- Register accepts optional `adminKey`; when it matches `ADMIN_PASSWORD`, the account is marked `IsAdmin=true` and can use admin APIs.
+- Register accepts optional `adminKey`; when it matches `ADMIN_PASSWORD`, the account is marked `IsAdmin=true` and can use admin APIs. If an `adminKey` is supplied but wrong (or ADMIN_PASSWORD unset), registration returns 400.
 
 ## State
 GET /api/state (public)

Endpoints/AuthEndpoints.cs

@@ -35,7 +35,13 @@ public static class AuthEndpoints
             var (hash, salt) = PasswordHasher.HashPassword(request.Password);
             var adminKey = EndpointHelpers.TrimTo(request.AdminKey, 128);
             var expectedAdminKey = config["ADMIN_PASSWORD"];
-            var isAdmin = !string.IsNullOrWhiteSpace(expectedAdminKey) && adminKey == expectedAdminKey;
+            var wantsAdmin = !string.IsNullOrWhiteSpace(adminKey);
+            if (wantsAdmin)
+            {
+                if (string.IsNullOrWhiteSpace(expectedAdminKey) || adminKey != expectedAdminKey)
+                    return Results.BadRequest(new { error = "Invalid admin key." });
+            }
+            var isAdmin = wantsAdmin;
 
             var player = new Player
             {