feat(10.1-01): run registered widget actions through a cabana-owned route

- pact: AdminClientAssets, AdminAction, AdminActionInput, AdminActionResult,
  HasAdminActions and AdminPartialData contracts
- fields.yaml type: widget with widget, action and fill keys; boot checks the
  plugin tag prefix, the registered action and writable scalar fill fields
- POST .../widgets/{field} behind requireAjax, controller and action
  permissions, scoped non-locking record read and a server-side fill filter
- typed OpenAPI operation, inventories and an acme conformance case

modules/cabana/contracts.go

@@ -73,6 +73,10 @@ type CompiledController struct {
 	Writable   []WritableField
 	// FieldRelations are the form's `type: relation` fields keyed by field name.
 	FieldRelations map[string]*CompiledFieldRelation
+	// Actions are the controller's pact.HasAdminActions entries keyed by name:
+	// the single namespace that toolbar.buttons names and widget action: keys
+	// resolve through. create and delete are reserved built-in names.
+	Actions map[string]pact.AdminAction
 }
 
 // Registry is the immutable controller map keyed by controller ID.