feat(admin-console): Stage 4 — games & runtimes domain

Add the games, runtime, and engine-version pages over the existing lobby,
runtime, and engine-version services (no new business logic).

- GET/POST /_gm/games                         list + create public game
- GET      /_gm/games/{id}                    detail incl. runtime snapshot
- POST     /_gm/games/{id}/force-start|stop    game state actions
- POST     /_gm/games/{id}/ban-member          ban a member (uuid + reason)
- POST     /_gm/games/{id}/runtime/restart|patch|force-next-turn
- GET/POST /_gm/engine-versions               registry + register
- POST     /_gm/engine-versions/{ver}/disable disable a version

Console depends on GameAdmin / RuntimeAdmin / EngineVersionAdmin interfaces
(satisfied by the concrete services) so the pages render in tests without a
database. Collection-mutating POSTs are mounted on the collection path to avoid
a static-vs-param route conflict in gin. Writes flow through the CSRF guard and
redirect back; the create form parses datetime-local as UTC.

Tests: list/detail (with and without a runtime), create (visibility/owner/time
assertions), force-start (+ bad-CSRF), ban-member (+ bad uuid), runtime patch
(+ missing version), engine-version list/register/disable, and unavailable.

Docs: backend/docs/admin-console.md page inventory extended.

backend/internal/server/handlers_admin_console.go

@@ -26,10 +26,13 @@ type AdminConsoleHandlers struct {
 	renderer *adminconsole.Renderer
 	csrf     *adminconsole.CSRF
 	assets   http.Handler
-	monitor  opsstatus.Reader
-	ready    func() bool
-	users    UserAdmin
-	logger   *zap.Logger
+	monitor        opsstatus.Reader
+	ready          func() bool
+	users          UserAdmin
+	games          GameAdmin
+	runtime        RuntimeAdmin
+	engineVersions EngineVersionAdmin
+	logger         *zap.Logger
 }
 
 // AdminConsoleDeps bundles the collaborators for the operator console. Every
@@ -40,10 +43,13 @@ type AdminConsoleHandlers struct {
 type AdminConsoleDeps struct {
 	Renderer *adminconsole.Renderer
 	CSRF     *adminconsole.CSRF
-	Monitor  opsstatus.Reader
-	Ready    func() bool
-	Users    UserAdmin
-	Logger   *zap.Logger
+	Monitor        opsstatus.Reader
+	Ready          func() bool
+	Users          UserAdmin
+	Games          GameAdmin
+	Runtime        RuntimeAdmin
+	EngineVersions EngineVersionAdmin
+	Logger         *zap.Logger
 }
 
 // NewAdminConsoleHandlers constructs the console handler set from deps. It
@@ -77,10 +83,13 @@ func NewAdminConsoleHandlers(deps AdminConsoleDeps) *AdminConsoleHandlers {
 		renderer: renderer,
 		csrf:     csrf,
 		assets:   http.StripPrefix("/_gm/assets/", http.FileServer(http.FS(assetsFS))),
-		monitor:  deps.Monitor,
-		ready:    deps.Ready,
-		users:    deps.Users,
-		logger:   logger.Named("http.admin.console"),
+		monitor:        deps.Monitor,
+		ready:          deps.Ready,
+		users:          deps.Users,
+		games:          deps.Games,
+		runtime:        deps.Runtime,
+		engineVersions: deps.EngineVersions,
+		logger:         logger.Named("http.admin.console"),
 	}
 }