feat: scaffold unibus_admin gateway (Go REST + embed SPA placeholder)

Single Go binary: serves an embedded Mantine SPA and a small REST API over the
unibus control plane. Holds the operator ADMIN identity, signs every
control-plane request, never exposes a private key to the browser.

- internal/admin: Repo interface + mock + bus implementations, REST server
- repo_bus: rooms via pkg/client, members via signed GET (CanonicalRequest +
  SignEd25519), cluster via /healthz (CA-pinned), users via membership.Store
- identity loaded from pass entry or 0600 file (operator-identity JSON)
- go build CGO_ENABLED=0 green; go vet clean

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

embed.go

@@ -0,0 +1,21 @@
+package main
+
+import (
+	"embed"
+	"io/fs"
+)
+
+// webDist holds the compiled Mantine SPA. The `all:` prefix makes go:embed
+// include files whose names start with `_` or `.` too, so a hashed Vite asset is
+// never silently dropped from the bundle. The build pipeline (web/ -> pnpm build)
+// writes web/dist before `go build`, so the binary always ships a ready UI with
+// nothing to serve from disk at runtime.
+//
+//go:embed all:web/dist
+var webDist embed.FS
+
+// spaFS returns the embedded SPA rooted at its dist directory, so the file
+// server sees index.html and assets/ at the root rather than under web/dist/.
+func spaFS() (fs.FS, error) {
+	return fs.Sub(webDist, "web/dist")
+}