feat(10-02): filter choices and a fully typed admin API proven on the wire

- pact.FilterOptions on the model serves a scope filter's choices; a scope
  filter whose model lacks it fails activation (D-27)
- GET /{vendor}/{plugin}/{controller}/filters/{scope}/options answers a
  declared scope filter behind the controller permission with localized
  {value, label} choices, 404 otherwise
- Every admin route documents a typed success schema, and protected routes
  document 401, 403 and 404 (422 on writes); SuccessEnvelope is gone and
  logout writes a typed AdminLogoutData
- jsonScalar and fieldContext decode their served shapes
- TestPhase10OpenAPIConformance calls every inventoried route through the
  assembled router on PostgreSQL and decodes each body into its documented
  type with unknown fields disallowed, checking admin.json's schema ref
- The SPA aliases every new schema type; Tailwind no longer scans the
  generated API files, so API changes do not churn boardwalk/dist

cabana/query_test.go

@@ -236,6 +236,14 @@ func (queryRow) TableName() string { return "cabana_list_query_rows" }
 
 func (queryRow) FilterScopes() []string { return []string{"filterByGroup"} }
 
+// FilterOptions serves the grouped scope's choices (D-27).
+func (queryRow) FilterOptions(scope string) []pact.Option {
+	if scope != "filterByGroup" {
+		return nil
+	}
+	return []pact.Option{{Value: "4", Label: "demo::lang.group_four"}, {Value: "9", Label: "Group nine"}}
+}
+
 func (queryRow) FilterScope(name string, db *gorm.DB, value any) *gorm.DB {
 	if db == nil || name != "filterByGroup" {
 		return db
@@ -426,3 +434,4 @@ func sameIDs(got, want []int) bool {
 var _ pact.AdminRecordSource = queryController{}
 var _ pact.AdminPermissioned = queryController{}
 var _ pact.FilterScope = queryRow{}
+var _ pact.FilterOptions = queryRow{}