feat: add platform administration panel

[darwin67]

Summary

• add the initial read-only /admin LiveView with installation totals, exact user/organization/workspace lookup, recent public paste metadata, largest paste metadata, and cursor-paginated platform audit history
• reload platform authority for every administration read and notify mounted panels after revocation
• keep paste bodies out of admin results and suppress non-public capability IDs while retaining unique, non-secret LiveView stream identities
• backfill legacy inline paste sizes and create query-matching administration indexes concurrently under PostgreSQL advisory migration locking
• update the RFD 1 implementation checklist for the completed authorization and read-panel milestones

Routing and authorization

/admin is placed in the existing [:browser, :require_authenticated_user] pipeline and live_session :require_authenticated_user because every panel route requires an authenticated registered user. AdminLive adds the :require_platform_admin module-level on_mount hook as the separate installation-wide authorization boundary, while every context read independently reloads current authority.

Oracle review follow-up

Regression coverage was added before fixing the review findings:

• multiple non-public largest-paste rows no longer collapse onto one stream DOM ID
• legacy inline rows with size_bytes = NULL are backfilled, counted in storage totals, displayed with their computed size, and sorted defensively with nulls last
• administration indexes use CREATE INDEX CONCURRENTLY outside a DDL transaction with advisory migration locking

The migration regression runs against a temporary PostgreSQL database and verifies the backfill, index definitions, lock strategy, and disabled DDL transaction.

Validation

• mix precommit — 489 tests passed
• focused administration context, LiveView, and migration suites — 27 tests passed
• migration rollback/forward dry run with SQL logging confirmed DROP INDEX CONCURRENTLY and CREATE INDEX CONCURRENTLY
• make check-rfds — passed