[GRDM-60922] Add permission checks and update token verification for admin endpoints

[ndnhat1]

Purpose

Implement institutional admin API authorization and secure cron-triggered endpoints using HMAC-signed URLs instead of hardcoded tokens.

Changes

• Authorization Control: Added superuser_required decorator and permission mixins to restrict sensitive admin endpoints (statistics, quota recalc, management commands) to superusers or institutional admins.
• Signed URL Authentication: Replaced hardcoded token authentication with HMAC-signed, time-limited URLs for cron jobs.
• Login Form Configuration: Added ENABLE_LOGIN_FORM setting to conditionally disable password-based login in admin panel.
• View Security: Added PermissionRequiredMixin and get_object_or_404() to provider deletion views (collection, preprint, registration).

QA Notes

Documentation

Side Effects

Ticket

60922