feat(10-01): serve the embedded admin SPA at backend.uri with cookie login

- backend.uri prefix (default /backend) mounts the admin API at {prefix}/api/v1
  and the embedded SPA shell at {prefix} with an api/ JSON 404 fallback
- cookie transport: an X-Requested-With login sets the HttpOnly summer_admin
  cookie and returns no token; the backend guard reads the cookie after Bearer
- CSRF wrapper refuses cookie-only POST/PUT/DELETE without X-Requested-With
- boardwalk package embeds boardwalk/dist, rewrites index.html once per prefix
  and sets cache and security headers
- framework admin OpenAPI pipeline (swag, swagger2openapi, openapi-typescript)
  with prefix-relative paths and typed envelopes for the tracer routes
- admin/ Vite SPA: login, plugin rail, section panel and read-only list
  through the openapi-fetch client typed by the generated schema

admin/src/components/shell/AppShell.vue

@@ -0,0 +1,72 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useRoute } from 'vue-router'
+import { ChevronRight } from '@lucide/vue'
+import PluginRail from './PluginRail.vue'
+import SectionPanel from './SectionPanel.vue'
+import { t } from '../../app/i18n'
+import { controllerIdFromPath } from '../../app/controllerRoutes'
+import { currentUser } from '../../state/useAuth'
+import { activeEntry } from '../../state/useNavigation'
+
+const route = useRoute()
+
+const active = computed(() => activeEntry(String(route.params.vendor ?? ''), String(route.params.plugin ?? '')))
+
+const section = computed(() => {
+  const id = controllerIdFromPath(route.path)
+  return active.value?.sideMenu.find((item) => item.controller === id) ?? null
+})
+
+const displayName = computed(() => {
+  const user = currentUser.value
+  if (!user) {
+    return ''
+  }
+  const name = `${user.first_name} ${user.last_name}`.trim()
+  return name === '' ? user.login : name
+})
+
+const initials = computed(() =>
+  displayName.value
+    .split(/\s+/)
+    .filter(Boolean)
+    .slice(0, 2)
+    .map((part) => part.charAt(0).toUpperCase())
+    .join(''),
+)
+</script>
+
+<template>
+  <div class="flex min-h-screen bg-bg text-text">
+    <PluginRail />
+    <SectionPanel v-if="active" :entry="active" />
+    <div class="flex min-w-0 flex-1 flex-col">
+      <header class="flex h-header shrink-0 items-center justify-between border-b border-border bg-surface pr-6 pl-8">
+        <nav :aria-label="t('backend::lang.nav.breadcrumbs')" class="flex items-center gap-2">
+          <template v-if="active">
+            <span :class="section ? 'text-muted' : 'font-semibold'">{{ active.label }}</span>
+            <template v-if="section">
+              <ChevronRight :size="14" class="text-muted" aria-hidden="true" />
+              <span class="font-semibold" aria-current="page">{{ section.label }}</span>
+            </template>
+          </template>
+        </nav>
+        <div v-if="currentUser" class="flex h-input items-center gap-2.5 rounded-inner px-2">
+          <span
+            class="flex size-[34px] items-center justify-center rounded-full bg-accent text-[13px] font-bold text-on-accent"
+            aria-hidden="true"
+            >{{ initials }}</span
+          >
+          <span class="flex flex-col leading-tight">
+            <span class="font-semibold">{{ displayName }}</span>
+            <span v-if="currentUser.role" class="text-[12px] text-muted">{{ currentUser.role.name }}</span>
+          </span>
+        </div>
+      </header>
+      <main class="min-w-0 flex-1 px-8 py-7">
+        <slot />
+      </main>
+    </div>
+  </div>
+</template>