feat(10-02): filter choices and a fully typed admin API proven on the wire

- pact.FilterOptions on the model serves a scope filter's choices; a scope
  filter whose model lacks it fails activation (D-27)
- GET /{vendor}/{plugin}/{controller}/filters/{scope}/options answers a
  declared scope filter behind the controller permission with localized
  {value, label} choices, 404 otherwise
- Every admin route documents a typed success schema, and protected routes
  document 401, 403 and 404 (422 on writes); SuccessEnvelope is gone and
  logout writes a typed AdminLogoutData
- jsonScalar and fieldContext decode their served shapes
- TestPhase10OpenAPIConformance calls every inventoried route through the
  assembled router on PostgreSQL and decodes each body into its documented
  type with unknown fields disallowed, checking admin.json's schema ref
- The SPA aliases every new schema type; Tailwind no longer scans the
  generated API files, so API changes do not churn boardwalk/dist

admin/src/styles/main.css

@@ -1,5 +1,11 @@
 @import "tailwindcss";
 
+/* The generated API document and types carry prose, not classes: keep them
+   out of the class scan so an admin API change does not churn the built CSS
+   in boardwalk/dist (D-04 drift check). */
+@source not "../api/schema.d.ts";
+@source not "../../openapi";
+
 /* Self-hosted fonts (D-07). Whole-weight files carry latin and latin-ext with
    unicode-range, so Polish diacritics and basic Latin both resolve. */
 @import "@fontsource/dm-sans/400.css";