feat(10-01): serve the embedded admin SPA at backend.uri with cookie login

- backend.uri prefix (default /backend) mounts the admin API at {prefix}/api/v1
  and the embedded SPA shell at {prefix} with an api/ JSON 404 fallback
- cookie transport: an X-Requested-With login sets the HttpOnly summer_admin
  cookie and returns no token; the backend guard reads the cookie after Bearer
- CSRF wrapper refuses cookie-only POST/PUT/DELETE without X-Requested-With
- boardwalk package embeds boardwalk/dist, rewrites index.html once per prefix
  and sets cache and security headers
- framework admin OpenAPI pipeline (swag, swagger2openapi, openapi-typescript)
  with prefix-relative paths and typed envelopes for the tracer routes
- admin/ Vite SPA: login, plugin rail, section panel and read-only list
  through the openapi-fetch client typed by the generated schema

admin/src/views/NotFoundView.vue

@@ -0,0 +1,13 @@
+<script setup lang="ts">
+import { t } from '../app/i18n'
+
+defineProps<{ home?: boolean }>()
+</script>
+
+<template>
+  <section class="flex flex-col items-center gap-2 py-20 text-center">
+    <h1 class="text-[17px] font-bold">
+      {{ home ? t('backend::lang.nav.empty') : t('backend::lang.page.not_found') }}
+    </h1>
+  </section>
+</template>