Add POST /admin/delete for bypass-keyed leaderboard cleanup

Body: {entries: [{task, agent}, ...]}; deletes all submissions matching
each pair. Same bypass-key gate as /submit's dry/unlimited mode.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/api.py

@@ -399,6 +399,38 @@ def leaderboard_all():
     return jsonify({"tasks": tasks, "rows": out})
 
 
+@app.post("/admin/delete")
+def admin_delete():
+    """Delete leaderboard entries by (task, agent). Bypass-key gated.
+
+    Body: JSON {"entries": [{"task": "...", "agent": "..."}, ...]}
+    Returns count deleted per pair + total.
+    """
+    sent_key = request.headers.get("X-Bypass-Key", "").strip()
+    if not (BYPASS_KEY and sent_key
+            and __import__("hmac").compare_digest(sent_key, BYPASS_KEY)):
+        return jsonify({"error": "bypass key required"}), 403
+    payload = request.get_json(silent=True) or {}
+    entries = payload.get("entries") or []
+    if not isinstance(entries, list) or not entries:
+        return jsonify({"error": "body must be {entries: [{task, agent}, ...]}"}), 400
+    conn = _db()
+    deleted = []
+    for e in entries:
+        t, a = e.get("task"), e.get("agent")
+        if not (t and a):
+            continue
+        cur = conn.execute(
+            "DELETE FROM submissions WHERE task = ? AND agent = ?", (t, a)
+        )
+        deleted.append({"task": t, "agent": a, "rows": cur.rowcount})
+    conn.commit()
+    return jsonify({
+        "deleted": deleted,
+        "total_rows": sum(d["rows"] for d in deleted),
+    })
+
+
 @app.get("/healthz")
 def healthz():
     manifest = _manifest()