The admin API is open to everyone unless NODE_ENV is exactly production

Without ADMIN_TOKEN, the admin guard lets every caller in whenever openWithoutToken is set, and loadAdminAuth sets that flag to NODE_ENV !== 'production' (server-config.ts:29, admin.guard.ts:31). Only the server Dockerfile sets NODE_ENV=production (line 20), so the Compose deployment is safe. Any other way of running the built server without that variable serves an open admin API, whose settings, worlds and questions come through Contracts and Game Core.

Impact: A server started outside the image with no NODE_ENV and no ADMIN_TOKEN lets anonymous callers rewrite game rules, worlds and the question bank, answer keys included.

Recommendation (small effort): Invert the default: open only when NODE_ENV is explicitly 'development' or 'test', and refuse to start without ADMIN_TOKEN otherwise. Add a test for the unset-NODE_ENV case.