feat(webapp): extend admin workers endpoint and unify admin api auth (#3390)

Extends the admin worker groups endpoint with a GET loader and more
fields on POST (type, hidden, workloadType, cloudProvider, location,
staticIPs, enableFastPath), and pulls the PAT + admin check that was
inlined or locally duplicated across every admin.api route into a shared
helper in personalAccessToken.server.ts. The generic
authenticateAdminRequest returns a discriminated result;
requireAdminApiRequest is the thin Remix loader/action wrapper that
throws. The neverthrow-style route (platform-notifications.ts) now
composes the generic helper instead of duplicating the check. Verified
locally against GET (listing) and POST (new fields, invalid enum,
minimal backwards-compat).

.server-changes/admin-workers-endpoint.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Admin worker groups API: add GET loader and expose more fields on POST.