fix(admin_api): stop leaking the real .env on import

admin_api.py called load_dotenv() unconditionally at module level, so
merely importing it (e.g. pytest collecting
tests/unit/test_admin_effective_config.py) ran python-dotenv's upward
find_dotenv() search, loaded the real repo .env (secrets included),
and polluted os.environ for the rest of the test session.

Gate the load_dotenv() call behind `if __name__ == "__main__":` at the
same source location, so it still runs before the module-level
os.environ.get(...) constants when run as the entrypoint (`python
admin_api.py` is unchanged) but never fires on a plain import.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

admin_api.py

@@ -29,7 +29,14 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 
 from dotenv import load_dotenv
 
-load_dotenv()
+if __name__ == "__main__":
+    # Load the repo .env ONLY when this file is run as the entrypoint
+    # (`python admin_api.py`). A bare module-level load_dotenv() here used to
+    # fire on every import too -- including pytest collection -- leaking the
+    # real repo .env (secrets included) into any process that merely imports
+    # this module. This runs before the os.environ.get(...) constants below,
+    # so `python admin_api.py` still behaves identically.
+    load_dotenv()
 from runtime.env_overrides import load as _load_overrides  # noqa: E402
 _load_overrides()
 from runtime import env_overrides  # noqa: E402