feat: admin area with customers, users, settings, audit log, service status (phase 5)

- customer CRUD wizard backend: per-system credential shapes validated via
  connector construction, AES-256-GCM at rest, write-only over the API
- ticketing connectors (jira/azure_devops/youtrack/demo) with test-connection
- user management: roles, disable (revokes sessions), force password reset,
  delete; self-demotion/disable/delete guards
- admin-editable runtime settings ({_id:app}) incl. atomizer URL override
- audit log written on every privileged mutation + filterable list API
- service status panel: mongo/atomizer/work-performer health + latency with
  late-bound breaker, sync and jobs status providers
- tabbed admin UI (customers wizard dialog, users table, settings, status, audit)
- compose: mongo nofile ulimit 64000 (1024 default crashed WiredTiger)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/domain/settings.go

@@ -0,0 +1,17 @@
+package domain
+
+import "time"
+
+// AppSettings is the single admin-editable runtime settings document
+// ({_id:"app"}, §4.8). Env vars are the defaults; these override where the
+// spec marks them overridable.
+type AppSettings struct {
+	ID                      string    `bson:"_id" json:"-"`
+	BrandingName            string    `bson:"brandingName" json:"brandingName"`
+	AtomizerBaseURLOverride string    `bson:"atomizerBaseUrlOverride" json:"atomizerBaseUrlOverride"`
+	HideCompetingClaims     bool      `bson:"hideCompetingClaims" json:"hideCompetingClaims"`
+	DefaultPollIntervalSec  int       `bson:"defaultPollIntervalSec" json:"defaultPollIntervalSec"`
+	DefaultCustomerBudget   float64   `bson:"defaultCustomerBudget" json:"defaultCustomerBudget"`
+	UpdatedAt               time.Time `bson:"updatedAt" json:"updatedAt"`
+	Version                 int64     `bson:"version" json:"version"`
+}