feat: admin area with customers, users, settings, audit log, service status (phase 5)

- customer CRUD wizard backend: per-system credential shapes validated via
  connector construction, AES-256-GCM at rest, write-only over the API
- ticketing connectors (jira/azure_devops/youtrack/demo) with test-connection
- user management: roles, disable (revokes sessions), force password reset,
  delete; self-demotion/disable/delete guards
- admin-editable runtime settings ({_id:app}) incl. atomizer URL override
- audit log written on every privileged mutation + filterable list API
- service status panel: mongo/atomizer/work-performer health + latency with
  late-bound breaker, sync and jobs status providers
- tabbed admin UI (customers wizard dialog, users table, settings, status, audit)
- compose: mongo nofile ulimit 64000 (1024 default crashed WiredTiger)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/http/server.go

@@ -31,6 +31,13 @@ type Server struct {
 	checks       []ReadinessCheck
 	startedAt    time.Time
 	httpSrv      *http.Server
+
+	// late-bound subsystem hooks (see providers.go)
+	atomizer     BreakerInfo
+	performer    BreakerInfo
+	syncProvider StatusProvider
+	jobsProvider StatusProvider
+	syncTrigger  func(customerID string)
 }
 
 func New(cfg *config.Config, log *slog.Logger, reg *metrics.Registry, st *store.Store, fs *files.Store) *Server {
@@ -58,6 +65,7 @@ func New(cfg *config.Config, log *slog.Logger, reg *metrics.Registry, st *store.
 	mux.HandleFunc("GET /metricsz", s.handleMetricsz)
 	s.routesAuth(mux)
 	s.routesProfile(mux)
+	s.routesAdmin(mux)
 	s.routesWeb(mux)
 
 	s.httpSrv = &http.Server{