Protect admin service saves with the circuit breaker

[jerdaw]

Summary

• protect the admin service read and upsert with the shared Supabase circuit breaker
• convert resolved Supabase database errors into breaker-visible failures while preserving the expected not-found create path
• add route tests for read/upsert circuit rejection and resolved database errors
• record partial ADR-016 rollout progress and the remaining audit-transaction decision

Validation

• npm test -- --run tests/api/admin/save.test.ts tests/lib/resilience/circuit-breaker.test.ts tests/integration/circuit-breaker-db.test.ts (35 passed)
• npm test -- --run (218 files; 1,737 passed; 24 credential-gated skips)
• npm run lint
• npm run type-check
• npm run format:check
• npm run check:refs (156 files)
• npm run check:root
• pre-commit and pre-push hooks

Boundaries

• no service-data, schema, migration, RBAC, environment, or production changes
• post-save audit calls retain their existing mixed non-transactional semantics; ADR-016 keeps that decision and other routes open
• independently reviewed after two correction passes; final review has no findings