feat(cabana): widget action payload and data channel (quick-261006-eyj)

- pact.AdminActionInput.Payload (json.RawMessage) carries the widget's own
  JSON value untouched; pact.AdminActionResult.Data is passed through as data
- cabana decodes payload with a 64 KiB cap (422 on body), refuses it on the
  toolbar and record routes, and embeds Data once encoded with a 256 KiB cap
  (opaque 500 when larger or unencodable); fill stays filtered
- root .swaggo overrides json.RawMessage so swag keeps record_id and values;
  admin.json and schema.d.ts regenerated (payload?: unknown, data?: unknown)
- TestWidgetPayloadAndData covers pass-through, cap, refusal and data 500
- cabana and pact READMEs, partials-and-widgets and admin-spa docs updated

.swaggo

@@ -0,0 +1,7 @@
+// Type overrides for swag (read by scripts/check-admin-openapi.sh, which runs
+// swag v1.16.6 from the repository root). Without --parseDependency swag
+// cannot resolve encoding/json.RawMessage and silently emits a struct that
+// uses it as a bare object, dropping every one of its properties from
+// admin/openapi/admin.json and the generated TypeScript types. Documenting
+// json.RawMessage as an untyped value keeps cabana.AdminActionRequest whole.
+replace json.RawMessage any