fix: support admin auth for Telegram MiniApp mail viewing (#875)

* fix: support admin auth for Telegram MiniApp mail viewing (#852)

Admin users configured in miniAppUrl can now view emails via the
MiniApp without needing Telegram initData auth. The getMail endpoint
reads the x-admin-auth header (already sent by the frontend) to
bypass Telegram auth and address permission checks for admin users.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: extract isAdmin() as shared utility function

Reuse the x-admin-auth header check logic across worker.ts and
miniapp.ts via a common isAdmin() helper in utils.ts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: rename isAdmin to checkIsAdmin for consistency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: address PR review comments

- Remove unused getAdminPasswords import from worker.ts
- Return 404 when admin queries a non-existent mail

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

worker/src/utils.ts

@@ -216,6 +216,13 @@ export const getAdminPasswords = (c: Context<HonoCustomType>): string[] => {
     return c.env.ADMIN_PASSWORDS.filter((item) => item.length > 0);
 }
 
+export const checkIsAdmin = (c: Context<HonoCustomType>): boolean => {
+    const adminPasswords = getAdminPasswords(c);
+    if (!adminPasswords.length) return false;
+    const adminAuth = c.req.raw.headers.get("x-admin-auth");
+    return !!adminAuth && adminPasswords.includes(adminAuth);
+}
+
 export const getEnvStringList = (value: string | string[] | undefined): string[] => {
     if (!value) {
         return [];
@@ -359,6 +366,7 @@ export default {
     getAnotherWorkerList,
     getPasswords,
     getAdminPasswords,
+    checkIsAdmin,
     getEnvStringList,
     sendAdminInternalMail,
     checkCfTurnstile,