feat(09-01): implement separate-admin genre list tracer

- Audience-aware mint, verify, refresh, and backend guard keep frontend tokens compatible
- Cabana mounts raw admin login, list schema, and record list behind admin.jwt.secret
- Framework migration seeds Winter backend users and developer/publisher roles

surf/router.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"git.golem15.com/golem15/summercms/backpack"
+	"git.golem15.com/golem15/summercms/cabana"
 	"git.golem15.com/golem15/summercms/pact"
 	"git.golem15.com/golem15/summercms/party"
 	"git.golem15.com/golem15/summercms/towel"
@@ -518,6 +519,17 @@ func BuildRouter(app *backpack.App, plugins []party.Plugin) (*Router, error) {
 			}
 		}
 	}
+	admin, err := cabana.Activate(app, plugins)
+	if err != nil {
+		return nil, err
+	}
+	if admin != nil {
+		if err := r.RegisterMiddleware("summercms.cabana", "backend", admin.Middleware); err != nil {
+			return nil, err
+		}
+		r.BindPlugin("summercms.cabana")
+		admin.Mount(r)
+	}
 	for _, rt := range r.routes {
 		if _, err := r.wrap(rt); err != nil {
 			return nil, err