feat(09-01): implement separate-admin genre list tracer

- Audience-aware mint, verify, refresh, and backend guard keep frontend tokens compatible
- Cabana mounts raw admin login, list schema, and record list behind admin.jwt.secret
- Framework migration seeds Winter backend users and developer/publisher roles

lagoon/migrations.go

@@ -57,8 +57,8 @@ func migrator(gdb *gorm.DB, pluginID string, migrations []*gormigrate.Migration)
 	}, migrations), nil
 }
 
-// Migrate runs the framework-owned system_files set first, then each
-// plugin's HasMigrations set in party.Activate order.
+// Migrate runs the framework-owned system_files and backend-admin sets
+// first, then each plugin's HasMigrations set in party.Activate order.
 func Migrate(gdb *gorm.DB, plugins []party.Plugin) error {
 	if gdb == nil {
 		return fmt.Errorf("lagoon: gorm db is nil")
@@ -70,6 +70,13 @@ func Migrate(gdb *gorm.DB, plugins []party.Plugin) error {
 	if err := m.Migrate(); err != nil {
 		return fmt.Errorf("lagoon: migrate system_files: %w", err)
 	}
+	admin, err := migrator(gdb, "summercms.cabana", BackendAdminMigrations)
+	if err != nil {
+		return err
+	}
+	if err := admin.Migrate(); err != nil {
+		return fmt.Errorf("lagoon: migrate backend admin: %w", err)
+	}
 	for _, p := range plugins {
 		hm, ok := p.(pact.HasMigrations)
 		if !ok {