feat(09-01): implement separate-admin genre list tracer

- Audience-aware mint, verify, refresh, and backend guard keep frontend tokens compatible
- Cabana mounts raw admin login, list schema, and record list behind admin.jwt.secret
- Framework migration seeds Winter backend users and developer/publisher roles

pact/capabilities.go

@@ -7,6 +7,7 @@ import (
 
 	"git.golem15.com/golem15/summercms/bonfire"
 	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
 )
 
 // HasCommands is implemented by plugins that register console commands.
@@ -111,6 +112,116 @@ type HasAdminControllers interface {
 	AdminControllers() []AdminController
 }
 
+// AdminAssets is the plugin-owned embedded tree of Winter admin YAML.
+// Paths are relative to the plugin root (controllers/..., models/...).
+type AdminAssets interface {
+	AdminFS() fs.FS
+}
+
+// AdminPermissioned is the D-03 permission list enforced before schema or SQL.
+type AdminPermissioned interface {
+	RequiredPermissions() []string
+}
+
+// AdminRecordSource supplies the GORM model the generic admin handlers query.
+// NewRecord returns a pointer to the model struct.
+type AdminRecordSource interface {
+	NewRecord() any
+}
+
+// Permission is one registerPermissions() entry.
+type Permission struct {
+	Code  string
+	Tab   string
+	Label string
+	Roles []string
+}
+
+// HasPermissions is implemented by plugins that declare backend permissions.
+type HasPermissions interface {
+	Permissions() []Permission
+}
+
+// NavigationItem is one registerNavigation() entry. Controller is the admin
+// controller ID; the SPA derives its route from that ID.
+type NavigationItem struct {
+	Label       string
+	Icon        string
+	Permissions []string
+	Order       int
+	Controller  string
+	SideMenu    []NavigationItem
+}
+
+// HasNavigation is implemented by plugins that declare backend navigation.
+type HasNavigation interface {
+	Navigation() []NavigationItem
+}
+
+// SettingsItem is one registerSettings() entry.
+type SettingsItem struct {
+	Code        string
+	Label       string
+	Description string
+	Category    string
+	Icon        string
+	Model       string
+	Order       int
+	Keywords    []string
+	Permissions []string
+}
+
+// HasSettings is implemented by plugins that declare settings screens.
+type HasSettings interface {
+	Settings() []SettingsItem
+}
+
+// Option is one dropdown choice. Label may be a phrase key until request time.
+type Option struct {
+	Value string `json:"value"`
+	Label string `json:"label"`
+}
+
+// DropdownOptionsProvider serves method-backed dropdown options.
+type DropdownOptionsProvider interface {
+	DropdownOptions(field string) []Option
+}
+
+// ListExtendQuery optionally narrows the admin list query.
+type ListExtendQuery interface {
+	ListExtendQuery(ctx context.Context, db *gorm.DB) *gorm.DB
+}
+
+// FormExtendQuery optionally narrows admin form record lookup.
+type FormExtendQuery interface {
+	FormExtendQuery(ctx context.Context, db *gorm.DB) *gorm.DB
+}
+
+// FormBeforeCreate optionally rejects or stamps a record before insert.
+type FormBeforeCreate interface {
+	FormBeforeCreate(ctx context.Context, model any) error
+}
+
+// FormBeforeUpdate optionally rejects or stamps a record before update.
+type FormBeforeUpdate interface {
+	FormBeforeUpdate(ctx context.Context, model any) error
+}
+
+// RelationExtendManageQuery optionally narrows relation-manager candidates.
+type RelationExtendManageQuery interface {
+	RelationExtendManageQuery(ctx context.Context, relation string, db *gorm.DB) *gorm.DB
+}
+
+// RelationBeforeLink optionally stamps pivot columns before a link insert.
+type RelationBeforeLink interface {
+	RelationBeforeLink(ctx context.Context, relation string, parent, related any, pivot map[string]any) error
+}
+
+// FilterScope is a model method referenced by a config_filter scope name.
+type FilterScope interface {
+	FilterScope(name string, db *gorm.DB, value any) *gorm.DB
+}
+
 // HasLang is implemented by plugins that ship embedded translation YAML
 // under lang/<locale>/<group>.yaml.
 type HasLang interface {
@@ -137,8 +248,6 @@ type OptionalMessage interface {
 // packages exist:
 //
 //	HasListeners
-//	HasNavigation
-//	HasPermissions
 //	HasSchedule
 //
 // The kernel type-asserts HasConfig (party, before Register), HasCommands