feat(10-01): serve the embedded admin SPA at backend.uri with cookie login

- backend.uri prefix (default /backend) mounts the admin API at {prefix}/api/v1
  and the embedded SPA shell at {prefix} with an api/ JSON 404 fallback
- cookie transport: an X-Requested-With login sets the HttpOnly summer_admin
  cookie and returns no token; the backend guard reads the cookie after Bearer
- CSRF wrapper refuses cookie-only POST/PUT/DELETE without X-Requested-With
- boardwalk package embeds boardwalk/dist, rewrites index.html once per prefix
  and sets cache and security headers
- framework admin OpenAPI pipeline (swag, swagger2openapi, openapi-typescript)
  with prefix-relative paths and typed envelopes for the tracer routes
- admin/ Vite SPA: login, plugin rail, section panel and read-only list
  through the openapi-fetch client typed by the generated schema

admin/src/components/shell/PluginRail.vue

@@ -0,0 +1,43 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { RouterLink, useRoute } from 'vue-router'
+import { Sun } from '@lucide/vue'
+import { t } from '../../app/i18n'
+import { iconFor } from '../../app/icons'
+import { activeEntry, firstControllerPath, railEntries } from '../../state/useNavigation'
+
+const route = useRoute()
+
+const active = computed(() => activeEntry(String(route.params.vendor ?? ''), String(route.params.plugin ?? '')))
+
+const items = computed(() =>
+  railEntries.value.map((entry) => ({
+    entry,
+    to: firstControllerPath(entry) ?? '/',
+    icon: iconFor(entry.icon),
+    current: active.value?.code === entry.code,
+  })),
+)
+</script>
+
+<template>
+  <nav
+    :aria-label="t('backend::lang.nav.plugins')"
+    class="flex w-rail shrink-0 flex-col items-center gap-1.5 border-r border-side-border bg-side pt-3.5 pb-3"
+  >
+    <span class="mb-3.5 flex size-10 items-center justify-center rounded-inner bg-accent-soft" title="SummerCMS">
+      <Sun :size="22" class="text-accent" aria-hidden="true" />
+    </span>
+    <RouterLink
+      v-for="item in items"
+      :key="item.entry.code"
+      :to="item.to"
+      :aria-current="item.current ? 'page' : undefined"
+      :class="item.current ? 'bg-accent-soft font-bold text-accent' : 'text-side-text hover:bg-side-hover hover:text-white'"
+      class="flex w-[68px] flex-col items-center gap-1 rounded-inner px-1.5 py-2 text-center text-[11px] leading-[1.2] tracking-[-0.01em] no-underline"
+    >
+      <component :is="item.icon" :size="20" aria-hidden="true" />
+      <span>{{ item.entry.label }}</span>
+    </RouterLink>
+  </nav>
+</template>