[Rewrite P5] Admin console parity + admin MCP server + CLI port #867

Parent: #860
Milestone: Phase 5: Admin console + MCP
Host: chappie · Expected cost: $1,400

The admin surface: HTTP routes, the static console, and the new MCP server for admins driving their relay with agents.

• HTTP admin routes (measured src/routes/admin + src/routes/callbacks + admissions/invoices routes, 244 LOC + auth provider 87 LOC): axum with the same session model (password-admin-auth-provider.ts semantics); serve the existing static console from resources/admin unchanged
• Admin API parity: every endpoint the console's JS calls (dashboard.js, notifications.js) responds with the same shapes — the console is the oracle and must work unmodified against the Rust relay
• MCP server for relay admins (nostream-admin crate, rmcp SDK): tools for the agent-driven admin workflow:
  • relay_status — uptime, worker health, connection count, version, NIP-11 doc
  • list_events / get_event / delete_event — audited event-store inspection with kind/pubkey filters
  • user_admin — admission, vanish, balance ops (mirrors the admin console's user actions)
  • invoices_* — list/inspect payment invoices
  • reports_* — NIP-56 report triage: list, action (hide/allow), audit trail
  • settings_get / settings_set — the typed settings surface (schema-validated, same validation the TS admin enforces)
  • maintenance_* — trigger retention/cleanup, read last-run stats
  • auth: the same admin credential model as the HTTP console; every tool call audit-logged to the delivery-log store
• nostream-cli port (measured 3,216 LOC): the documented pnpm run cli surface as a Rust subcommand set — help text, exit codes and the --all/--force/--older-than/--kinds clean-db semantics ported exactly (measured test rows in the CLI integration suite)

Acceptance: the unmodified TS-era admin console performs every action against the Rust relay; the MCP server answers tools/list with the tool set above and each tool passes an integration test against a running Rust relay; the CLI port passes the TS CLI integration tests re-expressed.