v4: expose operator admin HTTP API

[Phloraxx]

Scope

Fourteenth stacked PayGate v4 implementation slice. Depends on PR #55.

Implements

• password-only admin session HTTP with Secure/HttpOnly/SameSite=Strict web cookie and optional Android Bearer token
• shared GET /admin/overview and GET /admin/activity endpoints
• searchable/filterable admin Payments list/detail and direct PATCH editing
• Settings read/update for webhook endpoint with generated signing secret shown only on create/rotation
• explicit one-webhook retry endpoint
• collection-profile list/upsert/activate endpoints; routing remains server-owned
• merchant API-key list/create/revoke endpoints; plaintext key shown only at creation
• active PayGate-device read, one-time QR pairing-session creation and revoke endpoints
• pairing response can include the App-Link URL; token remains short-lived and one-use
• stable snake_case JSON contract across Overview, Activity, profiles, API keys and device state
• admin and relay authentication remain separate: admin logout/session expiry cannot stop notification relay

Tests

Endpoint tests cover web-cookie and Android-Bearer auth, unauthenticated rejection, non-unique event filtering, payment detail/edit including paid payer identity/history, webhook secret show-once behavior, profile activation, API-key show-once creation, and QR pairing URL creation. Full internal/v4/... unit tests, race tests, vet and diff checks pass locally.

Safety

Still no production route registration or v4 runtime cutover. Existing v3 server remains untouched.