All new Admin UI

The Colonel admin frontend has been rebuilt into a proper web console. The CLI and admin API now share the same core: Operations::* is extracted so every capability is written once and served three ways (op call, CLI, UI), instead of the old split where the CLI was full, and the UI lagged behind. The admin app also runs on its own Rolldown-Vite entry, out of the customer bundle.

Every mutating operation is now recorded through AdminAuditEvent (actor, verb, target, result). The console covers Customers, Receipts, Domains, Organizations, System, BannedIPs, and Usage, and surfaces powers that were previously CLI-only, like Sessions, Broadcast banner, Queue DLQ, Domain toolbox, and Email/rate-limit tools. Also includes a new opt-in network isolation (site.admin.allowed_cidrs) and explicit operation logging.