feat(admin-console): Stage 1 — pipe + skeleton behind the gateway

Add the server-rendered operator console at /_gm, exposed publicly through
the gateway behind the existing admin_accounts Basic Auth.

Backend:
- new internal/adminconsole package (html/template Renderer, stateless HMAC
  CSRF signer, embedded stylesheet)
- /_gm route group reusing basicauth.Middleware(admin.Service) + a CSRF guard
  (per-operator token + same-origin check); dashboard landing page
- BACKEND_ADMIN_CONSOLE_CSRF_KEY config (per-process random fallback)

Gateway:
- new "admin" public route class (per-IP rate limit, body + GET/HEAD/POST
  method limits) classifying /_gm traffic
- reverse proxy to the backend /_gm surface, preserving Host and relaying the
  backend 401 Basic Auth challenge; 502 when the backend is unreachable
- GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_ADMIN_* config

dev-deploy:
- Caddy routes /_gm/* to the gateway
- bootstrap admin + stable CSRF key; enable Prometheus /metrics exporters on
  backend and gateway (forward-compat for a future Prometheus/Grafana stack)

Docs: ARCHITECTURE 14.1/16, FUNCTIONAL 10.2.1 (+ru mirror), backend and
gateway READMEs, new backend/docs/admin-console.md.

Tests: renderer + CSRF unit tests; backend router auth/render/asset/CSRF;
gateway classifier, proxy forwarding/Host/401/405/413/429/502.

gateway/internal/restapi/server_test.go

@@ -169,6 +169,31 @@ func TestDefaultPublicTrafficClassifier(t *testing.T) {
 			accept:    "text/html",
 			wantClass: PublicRouteClassBrowserBootstrap,
 		},
+		{
+			name:      "admin console root",
+			method:    http.MethodGet,
+			target:    "/_gm",
+			wantClass: PublicRouteClassAdmin,
+		},
+		{
+			name:      "admin console page wins over browser accept header",
+			method:    http.MethodGet,
+			target:    "/_gm/users",
+			accept:    "text/html",
+			wantClass: PublicRouteClassAdmin,
+		},
+		{
+			name:      "admin console asset wins over browser asset shape",
+			method:    http.MethodGet,
+			target:    "/_gm/assets/console.css",
+			wantClass: PublicRouteClassAdmin,
+		},
+		{
+			name:      "admin console form post",
+			method:    http.MethodPost,
+			target:    "/_gm/users/123/sanctions",
+			wantClass: PublicRouteClassAdmin,
+		},
 	}
 
 	for _, tt := range tests {
@@ -215,6 +240,11 @@ func TestPublicRouteClassNormalized(t *testing.T) {
 			input: PublicRouteClassPublicMisc,
 			want:  PublicRouteClassPublicMisc,
 		},
+		{
+			name:  "admin",
+			input: PublicRouteClassAdmin,
+			want:  PublicRouteClassAdmin,
+		},
 		{
 			name:  "unknown collapses to misc",
 			input: PublicRouteClass("unexpected"),