feat(admin): apix-admin UI at admin.api-index.org

Internal maintainer dashboard: global stats, sandbox list with
tier-filter and pagination, sandbox drill-down with D3 world map,
tier-promotion form. API-key auth via HttpOnly cookie. Port 8084,
rolling a/b deploy alongside the existing service pairs.

- apix-common: AdminSandboxSummary, AdminSandboxListResponse, AdminStatsResponse DTOs
- apix-registry: AdminResource (4 endpoints), SandboxService.listAllSandboxes + getGlobalStats
- apix-registry: SandboxResource GET /{uuid}/dashboard endpoint (was missing — fixes portal 500)
- apix-portal: RegistryClient path corrected to /dashboard
- apix-admin: new Quarkus module — auth filter, registry REST client, 3 resources, 6 Qute templates, admin.js
- infra: Dockerfile.admin, docker-compose admin-a/b services, Caddyfile admin.api-index.org block
- scripts: deploy-bluegreen.sh extended for admin-a/b

Co-Authored-By: Mira Rehfeld <noreply@anthropic.com>

infra/Caddyfile

@@ -41,6 +41,20 @@ demo.api-index.org {
 	header -Server
 }
 
+admin.api-index.org {
+	reverse_proxy admin-a:8084 admin-b:8084 {
+		lb_policy       first
+		health_uri      /q/health/live
+		health_interval 5s
+		fail_duration   30s
+	}
+	header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+	header X-Content-Type-Options "nosniff"
+	header X-Frame-Options "DENY"
+	header Referrer-Policy "strict-origin"
+	header -Server
+}
+
 git.api-index.org {
 	reverse_proxy gitea:3001
 	header Strict-Transport-Security "max-age=31536000; includeSubDomains"

infra/Dockerfile.admin

@@ -0,0 +1,8 @@
+FROM eclipse-temurin:21-jre-alpine
+RUN addgroup -S apix && adduser -S apix -G apix
+WORKDIR /app
+COPY apix-admin/target/quarkus-app/ quarkus-app/
+RUN chown -R apix:apix /app
+USER apix
+EXPOSE 8084
+ENTRYPOINT ["java", "-jar", "quarkus-app/quarkus-run.jar"]

infra/docker-compose.yml

@@ -173,6 +173,38 @@ services:
       retries: 3
     restart: unless-stopped
 
+  # ── Admin UI (a/b) ────────────────────────────────────────────────────────
+
+  admin-a:
+    image: apix-admin:latest
+    environment:
+      APIX_REGISTRY_URL: http://registry-a:8180
+      APIX_API_KEY: ${APIX_API_KEY}
+      LOG_LEVEL: ${LOG_LEVEL:-INFO}
+    depends_on:
+      - registry-a
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8084/q/health/live || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    restart: unless-stopped
+
+  admin-b:
+    image: apix-admin:latest
+    environment:
+      APIX_REGISTRY_URL: http://registry-b:8180
+      APIX_API_KEY: ${APIX_API_KEY}
+      LOG_LEVEL: ${LOG_LEVEL:-INFO}
+    depends_on:
+      - registry-b
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8084/q/health/live || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    restart: unless-stopped
+
   # ── Edge proxy ────────────────────────────────────────────────────────────
 
   caddy: