Admin console

Phase 2 scaffold. Google SSO (@meettie.com restricted), API key management, connection inspection, provider config, webhook outbox, and status page land in subsequent commits.

Scope: docs/admin/phase2-scope.md