feat(12.1-01): declared record actions with an applicability rule

- pact.HasAdminRecordActions with AdminRecordAction (Applies, Run)
- config_form.yaml recordActions, compiled fail-loud
- show response meta.actions lists the permitted actions that apply
- POST .../{controller}/{id}/actions/{action}: record loaded and locked
  through the form scope; 404 out of scope, 409 when it does not apply
- RecordActions.vue with confirm and request flow (mounted by plan 02)
- roster fixture, smoke tests, OpenAPI, TS types, READMEs, docs

modules/cabana/phase10_csrf_test.go

@@ -67,12 +67,13 @@ func TestPhase10CSRF(t *testing.T) {
 		})
 	}
 	// refresh, logout, settings put, create, bulk-delete, bulk action,
-	// widget action, toolbar action, update, delete, link, unlink, file
+	// widget action, toolbar action, update, delete, record action, link,
+	// unlink, file
 	// upload, file reorder, file caption, file remove, relation child
 	// create, update and delete, pivot update, child file upload, reorder,
 	// caption and remove
-	if unsafe != 24 {
-		t.Fatalf("walked %d state-changing routes, want 24: %v", unsafe, router.order)
+	if unsafe != 25 {
+		t.Fatalf("walked %d state-changing routes, want 25: %v", unsafe, router.order)
 	}
 
 	loginHandler := router.handlers[login]