feat: align mero-js with core namespace model (#28)

* feat: add namespace and group APIs to AdminApiClient

Namespaces:
- listNamespaces() -- GET /admin-api/namespaces
- getNamespaceIdentity(id) -- GET /admin-api/namespaces/:id/identity
- listNamespacesForApplication(appId) -- GET /admin-api/namespaces/for-application/:appId

Groups:
- listGroups() -- GET /admin-api/groups
- createGroup(request) -- POST /admin-api/groups
- getGroupInfo(id) -- GET /admin-api/groups/:id
- deleteGroup(id) -- DELETE /admin-api/groups/:id
- listGroupMembers(id) -- GET /admin-api/groups/:id/members
- listGroupContexts(id) -- GET /admin-api/groups/:id/contexts
- createGroupInvitation(id) -- POST /admin-api/groups/:id/invite
- joinGroup(request) -- POST /admin-api/groups/join
- joinGroupContext(id, request) -- POST /admin-api/groups/:id/join-context

Made-with: Cursor

* feat: add serviceName to CreateContextRequest and Context types

Made-with: Cursor

* docs: add Admin API section to README (namespaces, groups, contexts, services)

Made-with: Cursor

* fix: add missing unwrap() to namespace/group GET methods

Cursor bot review found new GET methods were returning the raw
{ data: T } envelope instead of unwrapping the inner payload.
Fix response types to represent the unwrapped shape and add
unwrap() calls consistent with the existing pattern.

Exceptions (intentional):
- getNamespaceIdentity: server has no data wrapper
- listGroupMembers: data has sibling selfIdentity field

Made-with: Cursor

* refactor: rename joinGroupContext to joinContext (route: /contexts/:id/join)

Made-with: Cursor

* refactor: remove inviteToContext, simplify joinContext to group-membership only

Made-with: Cursor

* feat(admin-api): align AdminApiClient with redesigned core routes (#29)

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Sandi Fatic <chefsale@users.noreply.github.com>

* feat: align all types with core namespace model, add comprehensive tests

- Fix all admin-api request/response types to match core's actual structs
  (namespaces, groups, contexts, TEE, invitations, capabilities as u32 bitmask)
- Add missing endpoints: listPackages, listPackageVersions
- Add requester field to all mutation request types
- Remove stale subscribeNamespace (route doesn't exist in core)
- Remove stale protocol field from CreateContextRequest
- Add 65 new unit tests covering all new/updated APIs (173 total)
- Rewrite E2E tests to use namespace -> group -> context flow
- Deprecate executorPublicKey in RPC (removed from core JSON-RPC)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: restrict push trigger to master only

Prevents redundant CI runs on feature branches that already have
pull_request checks. Eliminates cancelled push checks on PRs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Sandi Fatic <chefsale@users.noreply.github.com>
Co-authored-by: rtb-12 <ronit_c@me.iitr.ac.in>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 4 people

.github/workflows/ci.yml

@@ -3,7 +3,7 @@ name: CI
 on:
   push:
     branches:
-      - '**'
+      - master
   pull_request:
     branches:
       - master

README.md

@@ -422,6 +422,45 @@ See the `examples/` directory for complete usage examples:
 
 **Note**: Run `npm run build` before running the examples, as they import from the built library.
 
+## Admin API
+
+The `AdminApiClient` provides methods for managing Calimero node resources:
+
+### Namespaces (application instances)
+```typescript
+const namespaces = await admin.listNamespaces();
+const identity = await admin.getNamespaceIdentity(namespaceId);
+const appNamespaces = await admin.listNamespacesForApplication(appId);
+```
+
+### Groups (governance boundaries)
+```typescript
+const groups = await admin.listGroups();
+const group = await admin.createGroup({ applicationId: '...' });
+const info = await admin.getGroupInfo(groupId);
+const members = await admin.listGroupMembers(groupId);
+const contexts = await admin.listGroupContexts(groupId);
+```
+
+### Contexts (WASM execution instances)
+```typescript
+// Single-service app
+const ctx = await admin.createContext({ applicationId: '...' });
+
+// Multi-service app -- specify which service to run
+const ctx = await admin.createContext({
+  applicationId: '...',
+  serviceName: 'chat',
+});
+```
+
+### Cloud (TEE High Availability)
+```typescript
+import { CloudClient } from 'mero-js';
+const cloud = new CloudClient();
+cloud.enableHA({ groupId, contextId, redirectUrl });
+```
+
 ## Development
 
 ```bash