Migrate Admin to the standards catalog and managed platform runtime

[adrianwebb]

Adopt released SDK/Core/UI contracts, implement OAuth consent/device/email browser flows, restore active account/team guarantees, add truthful agent monitoring, and publish the managed Admin component.

[adrianwebb]

Implementation is now in draft PR #3. The browser BFF, real auth pages, managed image/component bundle, monitoring foundation, and local Reviewer handoff are included. Final clean build/image proof waits for the SDK/UI/Core/API RC chain.

[adrianwebb]

Release integration status (2026-08-26): the Admin Node build, 67-test acceptance suite, packed artifact verification, and npm provenance publication all pass. 0.12.59-rc.4 is available under npm next, but its multi-architecture image jobs stopped before build because the Admin production environment did not contain Docker Hub credentials.

I added the non-secret TREESEED_DOCKERHUB_USERNAME environment variable using the same established value as API. The remaining blocker is binding TREESEED_DOCKERHUB_TOKEN to the Admin repository's production environment. GitHub does not expose or permit copying the API environment's secret value with the current credentials, so an administrator must bind/enter that secret without disclosing it. Afterward we will cut a fresh RC (rather than retry rc.4, whose npm version is immutable), publish/read back the Admin component assets, and complete Platform → Deployment → pinned Platform composition.

[adrianwebb]

Follow-up: #8 standardized Admin on DOCKERHUB_USERNAME / DOCKERHUB_TOKEN, declared the bindings, and added a fail-fast presence check. 0.12.59-rc.5 passed clean verification and published to npm next, but release run https://github.com/treeseed-ai/admin/actions/runs/32978194477 proved that DOCKERHUB_TOKEN is not currently available in Admin's production environment. Both architecture jobs stopped before Docker login; the release job was therefore skipped.

DOCKERHUB_USERNAME is configured. An administrator now only needs to bind the existing standard DOCKERHUB_TOKEN secret to Admin's production environment. We can then rerun failed jobs on the same immutable rc.5 run, preserving the successful npm publication and avoiding another version cut.