feat(meals): enforce three lower-calorie dinners with media

backend/app/security.py

@@ -15,8 +15,8 @@ SESSION_COOKIE = "mp_session"
 SESSION_MAX_AGE = 60 * 60 * 24 * 30  # 30 days
 
 
-def require_admin(request: Request) -> None:
-    """Enforce a shared bearer token. 401 on bad/missing token, 503 if unset."""
+def require_admin(request: Request) -> str:
+    """Enforce the shared bearer token and return its configured principal."""
     expected = settings.ADMIN_TOKEN
     if not expected:
         raise HTTPException(
@@ -29,6 +29,7 @@ def require_admin(request: Request) -> None:
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid admin token",
         )
+    return (settings.ADMIN_EMAIL or "").strip() or "admin"
 
 
 def _signer() -> TimestampSigner: