feat(10-01): serve the embedded admin SPA at backend.uri with cookie login

- backend.uri prefix (default /backend) mounts the admin API at {prefix}/api/v1
  and the embedded SPA shell at {prefix} with an api/ JSON 404 fallback
- cookie transport: an X-Requested-With login sets the HttpOnly summer_admin
  cookie and returns no token; the backend guard reads the cookie after Bearer
- CSRF wrapper refuses cookie-only POST/PUT/DELETE without X-Requested-With
- boardwalk package embeds boardwalk/dist, rewrites index.html once per prefix
  and sets cache and security headers
- framework admin OpenAPI pipeline (swag, swagger2openapi, openapi-typescript)
  with prefix-relative paths and typed envelopes for the tracer routes
- admin/ Vite SPA: login, plugin rail, section panel and read-only list
  through the openapi-fetch client typed by the generated schema

admin/vite.config.ts

@@ -0,0 +1,34 @@
+import { defineConfig, type Plugin } from 'vite'
+import vue from '@vitejs/plugin-vue'
+import tailwindcss from '@tailwindcss/vite'
+
+// The committed build is path-agnostic (D-02): assets use a relative base and
+// index.html keeps the __SUMMER_ADMIN_BASE__ token, which the Go server
+// (boardwalk) replaces with the configured backend.uri. The dev server
+// replaces it with SUMMER_ADMIN_DEV_PREFIX and proxies the admin API to a
+// running `summer serve` at SUMMER_ADMIN_DEV_TARGET.
+const devPrefix = (process.env.SUMMER_ADMIN_DEV_PREFIX ?? '/backend').replace(/\/+$/, '')
+const devTarget = process.env.SUMMER_ADMIN_DEV_TARGET ?? 'http://localhost:8080'
+
+function devBase(): Plugin {
+  return {
+    name: 'summer-admin-dev-base',
+    apply: 'serve',
+    transformIndexHtml: (html) => html.replace('__SUMMER_ADMIN_BASE__', devPrefix),
+  }
+}
+
+export default defineConfig(({ command }) => ({
+  base: command === 'build' ? './' : '/',
+  plugins: [vue(), tailwindcss(), devBase()],
+  build: {
+    outDir: '../boardwalk/dist',
+    emptyOutDir: true,
+    sourcemap: false,
+  },
+  server: {
+    proxy: {
+      [`${devPrefix}/api`]: { target: devTarget, changeOrigin: false },
+    },
+  },
+}))