feat: implement GEWU service and local agent workflows

docs/acceptance/2026-10-14-admin-panel.md

@@ -0,0 +1,33 @@
+# Minimal admin panel — 14 October 2026
+
+Implemented `/admin` with human administrator sign-in, paged credential metadata,
+project-scoped issuance, one-time secret display, confirmed revocation and latest
+50 credential-management events. The activity log excludes runtime/agent logs.
+
+Baseline: application, tests, web and schema directories were already untracked;
+the agent submodule and several architecture documents were already dirty. No commit
+was made and unrelated changes were preserved. The shared operation catalog and
+bundled agent contract/hash were refreshed for the four new HTTP operations.
+
+PASS:
+
+- `scripts/python-tool pytest -q`: 179 tests.
+- `npm --prefix web run check`: TypeScript, ESLint, 17 frontend tests.
+- `npm --prefix web run build`: production bundle.
+- Ruff check and format check, mypy, module boundary checker.
+- API tests: viewer/mixed-agent denial, no authentication, CSRF/origin, body limit,
+  duplicate IDs, secret-free lists/events, self-revocation rejection, durable audit,
+  revocation invalidates bearer authentication and existing browser sessions.
+- Shared preview using disposable data: sign-in, credential/project/event reads,
+  credential creation (201), one-time secret displayed. No operator keys modified.
+- Live web `/admin` loads at `https://msi.tail0b014a.ts.net:10000/admin`; at a requested
+  390×844 viewport the preview reported 391×845 and no document horizontal overflow.
+- Local API restarted through PM2; health succeeds and unauthenticated admin reads
+  return authentication errors.
+
+LIMITED: the shared preview routed successive calls between multiple clients and
+repeatedly lost the signed-in state or failed snapshot calls. Full browser revocation,
+keyboard walkthrough and authenticated responsive screenshot inspection remain
+unverified. Component/API tests cover creation, confirmation, CSRF and revocation;
+component tests cover reconnect after session expiry. No screen-reader or axe audit
+was performed. The temporary fixture server was stopped after verification.