feat(12.1-01): declared record actions with an applicability rule

- pact.HasAdminRecordActions with AdminRecordAction (Applies, Run)
- config_form.yaml recordActions, compiled fail-loud
- show response meta.actions lists the permitted actions that apply
- POST .../{controller}/{id}/actions/{action}: record loaded and locked
  through the form scope; 404 out of scope, 409 when it does not apply
- RecordActions.vue with confirm and request flow (mounted by plan 02)
- roster fixture, smoke tests, OpenAPI, TS types, READMEs, docs

modules/cabana/relation_field.go

@@ -55,9 +55,13 @@ type RelationOption struct {
 }
 
 // RecordMeta is the record envelope meta: display labels per relation field,
-// in the same order as the ids in data.
+// in the same order as the ids in data. Actions are the declared record
+// actions the requesting admin may run and that apply to the record, in
+// declared order; only the show response fills it, and it is omitted when no
+// action is offered.
 type RecordMeta struct {
-	Labels map[string][]RelationOption `json:"labels"`
+	Labels  map[string][]RelationOption `json:"labels"`
+	Actions []RecordAction              `json:"actions,omitempty"`
 }
 
 // RecordEnvelope is the show, create and update response.