Rename gateway core.admin.admin_token to auth_token (alias-compatible)

[kvinwang]

Problem

Following #802, the KMS admin listener uses core.admin.auth_token, but the gateway's equivalent field is still core.admin.admin_token. Under a [core.admin] table that name also stutters (admin.admin_token). The two [core.admin] sections should use the same key.

Fix

Rename the gateway field to auth_token, keeping the old name working via a serde alias so existing gateway.toml files (and generated app configs) don't break:

#[serde(default, alias = "admin_token")]
pub auth_token: String,

• admin_auth.rs: read config.auth_token; error message points at core.admin.auth_token.
• First-party configs/docs/templates updated to auth_token: gateway.toml, gateway/docs/cluster-deployment.md, the dstack-app builder entrypoint, and the e2e test configs.
• The DSTACK_GATEWAY_ADMIN_TOKEN / ADMIN_API_TOKEN env vars are unchanged (a separate naming axis; renaming them would be a real break).
• Old configs using admin_token = "..." continue to deserialize unchanged — no migration required.

Verification

• cargo test -p dstack-gateway (26) passes, including a new admin_auth_token_reads_new_and_legacy_keys test that extracts an AdminConfig from both the new auth_token key and the legacy admin_token key (via figment + the serde alias) and asserts both land in auth_token.
• cargo clippy -p dstack-gateway clean; cargo fmt applied.

Note on e2e configs

The gateway e2e test fixtures (test-run/e2e/configs/gateway-*.toml, test.sh) intentionally keep the legacy admin_token key — it still works via the serde alias, and leaving them untouched avoids a needless merge conflict with #801 (which annotates those same lines). They can be migrated later.

[Copilot]

Pull request overview

This PR aligns dstack-gateway’s admin configuration key with other components by renaming [core.admin].admin_token to [core.admin].auth_token, while preserving backward compatibility via a Serde alias so existing gateway.toml files keep working unchanged.

Changes:

• Renamed gateway admin token config field to auth_token with #[serde(alias = "admin_token")] to keep legacy configs compatible.
• Updated gateway admin auth wiring and error messaging to reference core.admin.auth_token.
• Updated first-party configs, docs, and e2e fixtures to use the new auth_token key and added a unit test covering both keys.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
dstack/gateway/src/config.rs	Renames AdminConfig field to auth_token with legacy admin_token alias; adds a unit test for both keys.
dstack/gateway/src/admin_auth.rs	Switches token lookup to config.auth_token and updates the fail-closed error message to reference the new config key.
dstack/gateway/gateway.toml	Updates the default config to use auth_token and documents legacy key support.
dstack/gateway/dstack-app/builder/entrypoint.sh	Updates generated [core.admin] config to emit auth_token.
dstack/gateway/test-run/e2e/configs/gateway-{1,2,3}.toml	Updates e2e gateway configs to use auth_token.
dstack/gateway/test-run/e2e/test.sh	Updates the comment to match the new config key name used by the e2e configs.
dstack/gateway/docs/cluster-deployment.md	Updates documentation to reference core.admin.auth_token.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.