feat(admin): inspect selected startup configuration

[n30nex]

What this PR does

Add protected GET /api/v1/admin/config as the first read-only slice of #60. It reports selected startup settings: CORS options with Beacon defaults applied, whether auth is configured, and the number of configured broker workers. It never serializes the full Config/environment or exposes credential fields, broker addresses, channel material or internal paths. The CORS lists are copied at router construction and use the same resolved values passed to the middleware.

Depends on #146; merge auth first. This draft reuses that PR's exact commit as its parent. Review the config-only diff; the full dev diff includes the pending auth prerequisite. It will be rebased to the accepted auth baseline before leaving draft.

Missing config still disables admin access with 503; invalid credentials return 401. Valid credentials can read this endpoint with Cache-Control: no-store. Public routes and CORS preflights remain unchanged. Configuration writes/account operations stay in later slices of #60; broker_count is an actual configured-broker count, not the proposed but nonexistent tunable worker_count setting. Swagger describes this operation's required Authorization header without adding global authentication to public endpoints.

Type of change

• New feature
• Tests
• Docs / config

Checklist

• go build ./... passes
• gofmt -l . is empty
• go vet ./... passes
• go test ./... passes
• New behavior has tests
• Swagger regenerated and generated docs committed
• No DB or dependency changes
• I have read CONTRIBUTING.md

Testing notes

Local and native Pi full Go checks and focused Windows router/middleware race checks pass. Tests cover default/custom options, an exact response-field whitelist, credential omission, caller-slice mutation, stable repeated reads, denied requests, rejected writes, all existing admin-auth paths/methods and public CORS behavior. Native PostgreSQL integration tests ran without skipping. CI and CodeQL pass.

The exact combined ARM64 binary returned the expected configuration whitelist with a temporary private key; missing/wrong/duplicate/query/form credentials were rejected, and the key was absent from logs. That temporary instance used an isolated database and no live MQTT; its container/key file were removed. The Canadaverse preview includes this draft with prior candidates and matching corresponding source. Public admin access remains deliberately disabled; both feeds, public REST/CORS and WebSocket checks pass. The preceding server/web pair remains available for rollback.

AI-assisted implementation and testing under the contributor's standing authorization; no separate human review of this final diff is claimed.

[n30nex]

@MrAlders0n please review this change with your Claude agent as part of the September 13 Beacon review batch. The current candidate is c63a085932ae; validation and Pi evidence are in the PR description.

Early review is requested on the config-only delta linked in the description. Keep this draft until prerequisite #146 is merged and the branch is rebased. Please check secret exclusion and agreement with effective CORS settings. Issue #60 remains open for the remaining scope.