Pages opened from the front but their DATA was still proxied to the engine, so
while a generation ran (engine event loop GIL-busy) Tokens/Users/etc. showed no
data. Tokens and users are backed purely by auth.json under config_dir, which the
front already has — so it can answer them from disk with zero engine round-trip.

New codai/frontproxy/admin_data.py (register_admin_data): front handlers for
GET/POST/DELETE /admin/api/tokens and /admin/api/users, mirroring the engine
handlers exactly (same shapes/status codes), with sessions validated locally
against the shared secret and admin gating. Registered before the catch-all so
they're served here, not forwarded. The engine still reads auth.json fresh for
bearer/session auth, so tokens created via the front work for inference.

This fully unblocks the Tokens and Users pages during generation. Settings/
status/models-list are the next candidates (config + models.json + registry are
all local to the front too).

Verified via TestClient: full CRUD, 401/403 gating, and pass-through isolation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011DDv7BchtZQWsnPG6Jm49m