Delete unused admin and console paths

[SaladDay]

Summary

This deletes admin, console and TS-client paths that no current code produces. It is part of the AGENTS.md alignment (T3b in the architecture audit: "expose no setting without a caller", "no compatibility layers").

• Administrator copies.
  • Migration 000092 drops admin_resource_owners, admin_asset_copies and admin_audit_log.result_ids, none of which any route writes.
  • ResourceOwner becomes {resource_id, api_key}, and adminaudit loses ResultIDs.
  • The TS client, Web, the e2e fixtures, admin-api.md and console-api-usage.md (en and zh), PRODUCT.md and DESIGN.md are updated, and core.openapi.yaml is regenerated.
• Key kinds. Core only issues issued keys. The static and console arms are deleted in writeaudit, the TS client and Web.
• Tolerant session listing. Web's only implementation stubbed unrecognized: [].
  • listSessionsTolerant, TolerantSessionList, UnrecognizedSession and the unrecognized rows and strings are deleted.
  • CoreProjectReader moves into Web as ProjectClient.
• Vite build flags with no consumer. The five __OAC_WEB_* defines, the VITE_AGENT_* typings, docker-guide-config.ts, vite-config.test.ts, the .env.example entries and the OAC_WEB_* assignments in build-core-distribution.sh are deleted.
• sandbox_admin console gate. services/web never sends it.
  • The field, the "older console" 404 branch, the node_artifacts allowance and SandboxPageAccess.tsx are deleted.
  • The fleet hook's config query is deleted too.
• The retired /console/api-keys guard in services/web and its test are deleted.
• The flat node-payload fallback in services/web/node_installation.go is deleted.
  • oac init always publishes releases/<rev>/ plus active.json into the data volume Web serves.
  • compose-smoke.py is unchanged: its flat layout is oac init's input, not Web's.

Behaviour

• /core/v1 resource owners lose source and admin_audit_id, and audit entries lose result_ids. Historical admin-copy provenance shows as "Unknown".
• A write-audit source whose key kind is not issued is rejected as malformed.
• A 404 from /console/config is now an error.
• When OAC_WEB_NODE_PAYLOAD_DIR is set, it must hold a valid active.json.

Checks

• go build ./..., module vet, and services/web vet and tests.
• make check-sqlc and make check-openapi.
• DB tests, none skipped: auditpg, writeaudit, adminaudit, plus the fixture-touched store packages and integration tests.
• agents-client: typecheck and 739 tests.
• Web: typecheck, 384 vitest tests and build.
• Website: build and translation tests, make check-docs, check-names.py.
• Playwright was not run locally because no Chrome is installed; CI runs it.

Net: non-test −501 lines, test −477 lines, generated −64 lines.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}