Funnel Workers v0.4 — Phase 3 (admin auth + token expiry)