Add POST /admin/insert for direct leaderboard writes

Use case: backends like Kaggle that can't always be proxied server-side.
The maintainer runs the submit + poll locally with their own creds, then
POSTs the resulting score here. Same bypass-key gate as /admin/delete.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/api.py

@@ -431,6 +431,52 @@ def admin_delete():
     })
 
 
+@app.post("/admin/insert")
+def admin_insert():
+    """Insert a leaderboard row directly. Bypass-key gated.
+
+    Use for backends we can't proxy server-side (e.g. when Kaggle creds are
+    only available on the maintainer's machine — they run the submit + poll
+    locally and POST the resulting score here).
+
+    Body: JSON {"task": "...", "agent": "...", "primary": float,
+                "secondary": {...}, "n_rows": int|null, "sha256": str|null}
+    """
+    import datetime as dt
+    import json as _json
+    import uuid as _uuid
+
+    sent_key = request.headers.get("X-Bypass-Key", "").strip()
+    if not (BYPASS_KEY and sent_key
+            and __import__("hmac").compare_digest(sent_key, BYPASS_KEY)):
+        return jsonify({"error": "bypass key required"}), 403
+    payload = request.get_json(silent=True) or {}
+    task = payload.get("task")
+    agent = payload.get("agent")
+    primary = payload.get("primary")
+    if not (task and agent and isinstance(primary, (int, float))):
+        return jsonify({"error": "task, agent, primary required"}), 400
+    secondary = payload.get("secondary") or {}
+    n_rows = int(payload.get("n_rows") or -1)
+    sha = payload.get("sha256") or "manual_insert"
+    run_id = _uuid.uuid4().hex[:12]
+    now = dt.datetime.now(dt.timezone.utc).isoformat()
+    conn = _db()
+    conn.execute(
+        "INSERT INTO submissions VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        (run_id, task, agent, float(primary), _json.dumps(secondary),
+         sha, n_rows, "admin", now),
+    )
+    conn.commit()
+    return jsonify({
+        "run_id": run_id,
+        "task": task,
+        "agent": agent,
+        "primary": primary,
+        "secondary": secondary,
+    })
+
+
 @app.get("/healthz")
 def healthz():
     manifest = _manifest()