feat(admin-console): Stage 2 — dashboard monitoring

Turn the console landing page into an operational dashboard.

- new internal/opsstatus: read-only Postgres projection via go-jet — ping +
  per-status COUNT/GROUP BY on runtime_records, mail_deliveries,
  notification_routes, and a malformed-intent count; degrades per-probe into
  Snapshot.Errors rather than failing the page
- dashboard renders backend readiness, database health, the three status
  tables, the malformed count, and any collection errors; falls back to a
  "monitoring not wired" note when no reader is injected
- AdminConsoleHandlers now takes an AdminConsoleDeps struct (Monitor + Ready
  added) so later stages add service refs without churning the signature

Tests: opsstatus store test against a Postgres testcontainer (empty schema +
one enqueued delivery); dashboard render tests with a fake reader (with and
without monitoring).

Docs: ARCHITECTURE 14.1 + FUNCTIONAL 10.2.1 (+ru) describe the dashboard.
(Prometheus /metrics exporters were already enabled in dev-deploy in Stage 1.)

backend/internal/server/handlers_admin_console_test.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -8,18 +9,28 @@ import (
 	"testing"
 
 	"galaxy/backend/internal/adminconsole"
+	"galaxy/backend/internal/opsstatus"
 	"galaxy/backend/internal/server/middleware/basicauth"
 
 	"github.com/gin-gonic/gin"
 	"go.uber.org/zap"
 )
 
+// fakeMonitor is a static opsstatus.Reader for dashboard rendering tests.
+type fakeMonitor struct {
+	snapshot opsstatus.Snapshot
+}
+
+func (f fakeMonitor) Collect(context.Context) opsstatus.Snapshot {
+	return f.snapshot
+}
+
 func newConsoleTestRouter(t *testing.T) http.Handler {
 	t.Helper()
 	handler, err := NewRouter(RouterDependencies{
 		Logger:        zap.NewNop(),
 		AdminVerifier: basicauth.NewStaticVerifier("secret"),
-		AdminConsole:  NewAdminConsoleHandlers(nil, adminconsole.NewCSRF([]byte("test-key")), nil),
+		AdminConsole:  NewAdminConsoleHandlers(AdminConsoleDeps{CSRF: adminconsole.NewCSRF([]byte("test-key"))}),
 	})
 	if err != nil {
 		t.Fatalf("NewRouter: %v", err)
@@ -67,6 +78,68 @@ func TestAdminConsoleDashboardRenders(t *testing.T) {
 	}
 }
 
+func TestAdminConsoleDashboardShowsMonitoring(t *testing.T) {
+	monitor := fakeMonitor{snapshot: opsstatus.Snapshot{
+		PostgresHealthy:       true,
+		Runtimes:              []opsstatus.StatusCount{{Status: "running", Count: 3}, {Status: "stopped", Count: 1}},
+		MailDeliveries:        []opsstatus.StatusCount{{Status: "pending", Count: 2}},
+		NotificationRoutes:    []opsstatus.StatusCount{{Status: "published", Count: 9}},
+		NotificationMalformed: 4,
+		Errors:                []string{"notification route counts: boom"},
+	}}
+
+	handler, err := NewRouter(RouterDependencies{
+		Logger:        zap.NewNop(),
+		AdminVerifier: basicauth.NewStaticVerifier("secret"),
+		AdminConsole: NewAdminConsoleHandlers(AdminConsoleDeps{
+			CSRF:    adminconsole.NewCSRF([]byte("test-key")),
+			Monitor: monitor,
+			Ready:   func() bool { return true },
+		}),
+	})
+	if err != nil {
+		t.Fatalf("NewRouter: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/_gm/", nil)
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	body := rec.Body.String()
+	for _, want := range []string{
+		"Game runtimes", "running", "stopped",
+		"Mail deliveries", "pending",
+		"Notification routes", "published",
+		"Malformed notifications",
+		"notification route counts: boom",
+		"healthy",
+	} {
+		if !strings.Contains(body, want) {
+			t.Errorf("dashboard body missing %q", want)
+		}
+	}
+}
+
+func TestAdminConsoleDashboardWithoutMonitor(t *testing.T) {
+	router := newConsoleTestRouter(t) // no monitor wired
+
+	req := httptest.NewRequest(http.MethodGet, "/_gm/", nil)
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "Monitoring is not wired") {
+		t.Error("dashboard without a monitor should note that monitoring is unavailable")
+	}
+}
+
 func TestAdminConsoleServesAsset(t *testing.T) {
 	router := newConsoleTestRouter(t)
 
@@ -87,7 +160,7 @@ func TestAdminConsoleRequireCSRF(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 
 	csrf := adminconsole.NewCSRF([]byte("test-key"))
-	console := NewAdminConsoleHandlers(nil, csrf, nil)
+	console := NewAdminConsoleHandlers(AdminConsoleDeps{CSRF: csrf})
 
 	engine := gin.New()
 	engine.Use(func(c *gin.Context) {