feat(12.1-01): declared record actions with an applicability rule

- pact.HasAdminRecordActions with AdminRecordAction (Applies, Run)
- config_form.yaml recordActions, compiled fail-loud
- show response meta.actions lists the permitted actions that apply
- POST .../{controller}/{id}/actions/{action}: record loaded and locked
  through the form scope; 404 out of scope, 409 when it does not apply
- RecordActions.vue with confirm and request flow (mounted by plan 02)
- roster fixture, smoke tests, OpenAPI, TS types, READMEs, docs

admin/tests/fixtures/roster.record.json

@@ -0,0 +1,10 @@
+{
+  "data": { "id": 1, "name": "Ada Lovelace", "email": "ada@example.test" },
+  "meta": {
+    "labels": {},
+    "actions": [
+      { "name": "activate", "label": "Activate" },
+      { "name": "reinstate", "label": "Reinstate", "confirm": "Lift the ban on this person?" }
+    ]
+  }
+}