Restore /admin/insert for maintainer leaderboard corrections

Removed earlier for integrity, but the maintainer needs a path to fix
known-bad rows whose CSVs are no longer available (e.g. the autopipe-v2
figraph 0.824 entry that should be 0.788). Same bypass-key gate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/api.py

@@ -483,6 +483,45 @@ def admin_delete():
     })
 
 
+@app.post("/admin/insert")
+def admin_insert():
+    """Insert a leaderboard row directly. Bypass-key gated; intended for
+    maintainer corrections (e.g. backfilling a known score whose CSV is no
+    longer available). For routine scoring, use POST /submit.
+
+    Body: JSON {"task": "...", "agent": "...", "primary": float,
+                "secondary": {...}, "n_rows": int|null, "sha256": str|null}
+    """
+    import datetime as _dt
+    import json as _json
+    import uuid as _uuid
+
+    sent_key = request.headers.get("X-Bypass-Key", "").strip()
+    if not (BYPASS_KEY and sent_key
+            and __import__("hmac").compare_digest(sent_key, BYPASS_KEY)):
+        return jsonify({"error": "bypass key required"}), 403
+    payload = request.get_json(silent=True) or {}
+    task = payload.get("task")
+    agent = payload.get("agent")
+    primary = payload.get("primary")
+    if not (task and agent and isinstance(primary, (int, float))):
+        return jsonify({"error": "task, agent, primary required"}), 400
+    secondary = payload.get("secondary") or {}
+    n_rows = int(payload.get("n_rows") or -1)
+    sha = payload.get("sha256") or "manual_insert"
+    run_id = _uuid.uuid4().hex[:12]
+    now = _dt.datetime.now(_dt.timezone.utc).isoformat()
+    conn = _db()
+    conn.execute(
+        "INSERT INTO submissions VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        (run_id, task, agent, float(primary), _json.dumps(secondary),
+         sha, n_rows, "admin", now),
+    )
+    conn.commit()
+    return jsonify({"run_id": run_id, "task": task, "agent": agent,
+                    "primary": primary, "secondary": secondary})
+
+
 @app.post("/admin/repoll/<run_id>")
 def admin_repoll(run_id: str):
     """Re-trigger the Kaggle poll loop for a stuck/failed pending row, without