Fix sync auth, add cron script, update env.example

app/src/app/admin/page.tsx

@@ -56,7 +56,7 @@ export default function AdminPage() {
           <button
             onClick={async () => {
               setSyncing(true)
-              await fetch(`/api/admin/sync?secret=${process.env.NEXT_PUBLIC_SYNC_SECRET ?? ''}`, { method: 'POST' })
+              await fetch('/api/admin/sync', { method: 'POST' })
               setSyncing(false)
             }}
             className="bg-blue-600 text-white text-xs font-bold px-3 py-1.5 rounded-full disabled:opacity-60"

app/src/app/api/admin/sync/route.ts

@@ -29,8 +29,13 @@ export async function POST(req: Request) {
   const { searchParams } = new URL(req.url)
   const secret = searchParams.get('secret')
 
+  // Acepta secret (para cron) o sesión de admin (para el panel)
   if (secret !== process.env.ADMIN_SYNC_SECRET) {
-    return NextResponse.json({ error: 'No autorizado' }, { status: 401 })
+    const { getSession } = await import('@/lib/auth')
+    const session = await getSession()
+    if (!session || session.role !== 'ADMIN') {
+      return NextResponse.json({ error: 'No autorizado' }, { status: 401 })
+    }
   }
 
   const apiUrl = process.env.RESULTS_API_URL