portal: record that the admin-token cutover is complete (comment only)

The comment above ADMIN_TOKEN still said "set ADMIN_TOKEN_LEGACY=0 and rotate
both". Stale — and the direct reason a report claimed a rotation was
outstanding: ADMIN_TOKEN was minted new and WEBHOOK_TOKEN rotated on 2026-10-27,
and the legacy path was closed on 2026-10-28.

Comment only, no behaviour change. Rebranched onto the current main: an earlier
attempt had pinned an image built from a tree that predated the key-encryption
work, which would have reverted it.

app/main.py

@@ -207,9 +207,12 @@ WEBHOOK_TOKEN = os.environ.get("WEBHOOK_TOKEN", "")
 # generic webhooks cannot send headers), so anything that learns that URL — an OC
 # admin, OC's logs, this app's own access logs, a Referer — used to gain portal
 # admin. ADMIN_TOKEN is only ever sent as a header and never appears in a URL.
-# Cutover: while ADMIN_TOKEN_LEGACY is not "0" we also accept WEBHOOK_TOKEN on
+# Cutover COMPLETE (2026-10-28): ADMIN_TOKEN_LEGACY=0, so the legacy token no
-# /admin/* so the admin panel, the scheduler and the digest scripts keep working.
+# longer authenticates here (verified: ADMIN_TOKEN -> 200, WEBHOOK_TOKEN -> 403).
-# Set ADMIN_TOKEN everywhere, then set ADMIN_TOKEN_LEGACY=0 and rotate both.
+# ADMIN_TOKEN was minted new on 2026-10-27 and WEBHOOK_TOKEN was rotated the same
+# day, so NO rotation is outstanding — do not "finish" this by rotating again.
+# Callers must read ADMIN_TOKEN and fail loudly; never fall back to WEBHOOK_TOKEN,
+# which 403s and would turn a missing variable into a mid-run failure.
 ADMIN_TOKEN = os.environ.get("ADMIN_TOKEN", "")
 ADMIN_TOKEN_LEGACY = os.environ.get("ADMIN_TOKEN_LEGACY", "1") != "0"