feat(admin): add operational dashboard API - #327

reslove conflicts @Leemxiey

Closes #302

@Leemxiey the current head bf84889a325bc222a4c22efc0bfb44a1b01826a9 remains conflict-blocked and its CI run failed.

Please rebase onto current main, resolve the admin/metrics/notifications conflicts, and rerun the full build, lint, tests, and security checks. The operational dashboard endpoints must be authenticated and role-restricted, must not expose secrets or sensitive user data, and must consume health/projection metrics without adding protocol mutation authority.

Push the corrected head and request another review once CI is green.

@Leemxiey PR #327 was merged at head bf84889a325bc222a4c22efc0bfb44a1b01826a9 despite the unresolved review. Please open a focused remediation PR or request a maintainer-approved revert:

• Required CI failed, the head remained conflict-blocked, and there is no approving human review for these admin/operational endpoints.
• Protocol counts are incorrect: activeClaims already counts finalized: false, but pendingClaims subtracts all finalized claims from it; resolvedClaims = total - pending - finalized then compounds the error. Derive every lifecycle count from canonical indexed states and add partition/invariant tests.
• Health data includes hardcoded database.latencyMs: 0 and collapses dependency failures to only “degraded,” so the dashboard can present fabricated latency and insufficiently fail closed. Measure real bounded latency and distinguish unhealthy/unavailable/unknown.
• Every narrow endpoint calls getOperationalSummary(), triggering all database, Redis, queue, notification, webhook, metrics, and claim queries. Split collectors, bound/timeout dependency calls, and test partial dependency failure so one slow subsystem cannot hang every admin endpoint.
• Prove class-level authentication/role enforcement for each new route and ensure requestsByRoute, queue/webhook details, and infrastructure status are sanitized.

Please rebase the remediation onto current main, run full build/lint/tests/security checks, and obtain explicit authentication/operations maintainer approval before #302 is treated as completed.