Splitting the APIs is really the best option, since the public site only needs to be read-only, there's no reason for the write APIs to live on it. That also would give you the ability to implement additional restrictions more easily, like restricting the IP addresses that can access the admin site.
Failing that, using an API Key as Polynomial mentioned or a session token for accessing the APIs is next best option, as it allows you to call the APIs without having to send credentials with each request, which is potentially more secure.
However, it sounds like the security concerns you have around your application are fairly minimal and minor, so I'd say that basic auth with a sufficiently strong password and HTTPS might well be a perfectly acceptable initial implementation. Given that you're the only one who'll be writing to the site, I don't know that I agree with Polynomial's concerns about ugliness, or the the lack of universal support.
The insecurity issues around basic auth were covered in AviD's post you referencedpost you referenced, and if you wanted to mitigate those, you could implement a Sinatra-based auth module like Warden instead of using basic auth.
