feat: scaffold unibus_admin gateway (Go REST + embed SPA placeholder)

Single Go binary: serves an embedded Mantine SPA and a small REST API over the
unibus control plane. Holds the operator ADMIN identity, signs every
control-plane request, never exposes a private key to the browser.

- internal/admin: Repo interface + mock + bus implementations, REST server
- repo_bus: rooms via pkg/client, members via signed GET (CanonicalRequest +
  SignEd25519), cluster via /healthz (CA-pinned), users via membership.Store
- identity loaded from pass entry or 0600 file (operator-identity JSON)
- go build CGO_ENABLED=0 green; go vet clean

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,18 @@
+# Per-PC writable runtime state (never distributed).
+local_files/
+*.db
+*.db-shm
+*.db-wal
+*.id
+
+# Build artifacts
+/unibus_admin
+*.exe
+registry.db
+
+# Web build inputs (the compiled bundle in web/dist IS committed so the Go
+# binary always embeds a ready SPA; only the toolchain inputs are ignored).
+web/node_modules/
+web/.vite/
+web/*.tsbuildinfo
+*.local