feat(10-01): serve the embedded admin SPA at backend.uri with cookie login

- backend.uri prefix (default /backend) mounts the admin API at {prefix}/api/v1
  and the embedded SPA shell at {prefix} with an api/ JSON 404 fallback
- cookie transport: an X-Requested-With login sets the HttpOnly summer_admin
  cookie and returns no token; the backend guard reads the cookie after Bearer
- CSRF wrapper refuses cookie-only POST/PUT/DELETE without X-Requested-With
- boardwalk package embeds boardwalk/dist, rewrites index.html once per prefix
  and sets cache and security headers
- framework admin OpenAPI pipeline (swag, swagger2openapi, openapi-typescript)
  with prefix-relative paths and typed envelopes for the tracer routes
- admin/ Vite SPA: login, plugin rail, section panel and read-only list
  through the openapi-fetch client typed by the generated schema

admin/src/main.ts

@@ -0,0 +1,30 @@
+import { createApp } from 'vue'
+import App from './App.vue'
+import { createAdminRouter } from './app/router'
+import { onUnauthorized } from './api/client'
+import { clearUser, me } from './state/useAuth'
+import { loadNavigation } from './state/useNavigation'
+import './styles/main.css'
+
+async function boot(): Promise<void> {
+  // A 401 here only means "not signed in"; the router guard sends the
+  // visitor to the login route with the requested path as redirect.
+  const user = await me().catch(() => null)
+  if (user) {
+    await loadNavigation().catch(() => [])
+  }
+  const router = createAdminRouter()
+  onUnauthorized(() => {
+    clearUser()
+    const current = router.currentRoute.value
+    if (current.name !== 'login') {
+      void router.push({ name: 'login', query: { redirect: current.fullPath } })
+    }
+  })
+  const app = createApp(App)
+  app.use(router)
+  await router.isReady()
+  app.mount('#app')
+}
+
+void boot()