feat(10.1-01): render header and form partials into an allowlisted node tree

- fields.yaml type: partial with a bare path name and config_list.yaml
  headerPartial resolve to {ConfigDir}/_{name}.htm, parsed at boot; the
  controller must implement pact.AdminPartialData
- html/template render against a curated view model, then x/net/html
  ParseFragment and a tag, attribute and URL allowlist with 64 KiB, 2000-node
  and depth-32 caps; the model type and trusted template types are refused
- GET .../partials/{name} with optional ?id= loaded through the form scope
- golang.org/x/net becomes a direct requirement (D-18), no new module

modules/cabana/admin_openapi.go

@@ -446,6 +446,25 @@ func AdminWidgetAction() {}
 // @Router /{vendor}/{plugin}/{controller}/toolbar/{action} [post]
 func AdminToolbarAction() {}
 
+// AdminPartial documents the controller partial route.
+//
+// @Summary Render a controller partial
+// @Description Renders a declared header partial or form partial with html/template against the controller's view model and returns it as an allowlisted node tree: no HTML string. Without id the view model gets no record; id is accepted only for form partials and is loaded through the controller's form scope.
+// @Tags admin
+// @Produce json
+// @Security BackendBearer
+// @Param vendor path string true "Vendor"
+// @Param plugin path string true "Plugin"
+// @Param controller path string true "Controller"
+// @Param name path string true "Partial name"
+// @Param id query integer false "Record id for a form partial"
+// @Success 200 {object} Envelope[PartialView]
+// @Failure 401 {object} ErrorEnvelope
+// @Failure 403 {object} ErrorEnvelope
+// @Failure 404 {object} ErrorEnvelope
+// @Router /{vendor}/{plugin}/{controller}/partials/{name} [get]
+func AdminPartial() {}
+
 // AdminShow documents the record show route.
 //
 // @Summary Show an admin record