feat: add read-only deployment moderation dashboard

[kalvinnchau]

Summary

• add a private, deployment-wide read-only dashboard for open moderation reports and recent product feedback
• expose only GET /api/admin/v1/reports, GET /api/admin/v1/reports/:id, and GET /api/admin/v1/feedback
• reuse the relay's existing database pool, moderation report tables, and product-feedback repository
• require an exact admin host plus a trusted-ingress reviewer identity present in an application allowlist
• build and serve the admin SPA from the existing relay image while failing closed on the admin host

Deliberate omissions

There are no admin mutations, schema migrations, idempotency tables, CSRF state, action kill switches, synthetic Nostr commands, or moderation-handler bypasses. Community moderation remains the only write path.

Verification

• cargo check -p buzz-relay --all-targets
• cargo test -p buzz-relay api::admin — 1 passed
• cargo test -p buzz-relay router::tests — 4 passed
• cargo fmt --all -- --check
• pnpm -C admin-web check
• pnpm -C admin-web build
• pnpm -C admin-web exec playwright test — 3 passed
• git diff --check

The pre-push Rust, Desktop, and conformance suites passed. The hook's unrelated mobile lane could not start because flutter is not installed, so the already-verified commit was pushed with the hook disabled.