feat(admin): apix-admin UI at admin.api-index.org

Internal maintainer dashboard: global stats, sandbox list with
tier-filter and pagination, sandbox drill-down with D3 world map,
tier-promotion form. API-key auth via HttpOnly cookie. Port 8084,
rolling a/b deploy alongside the existing service pairs.

- apix-common: AdminSandboxSummary, AdminSandboxListResponse, AdminStatsResponse DTOs
- apix-registry: AdminResource (4 endpoints), SandboxService.listAllSandboxes + getGlobalStats
- apix-registry: SandboxResource GET /{uuid}/dashboard endpoint (was missing — fixes portal 500)
- apix-portal: RegistryClient path corrected to /dashboard
- apix-admin: new Quarkus module — auth filter, registry REST client, 3 resources, 6 Qute templates, admin.js
- infra: Dockerfile.admin, docker-compose admin-a/b services, Caddyfile admin.api-index.org block
- scripts: deploy-bluegreen.sh extended for admin-a/b

Co-Authored-By: Mira Rehfeld <noreply@anthropic.com>

scripts/setup-dev.sh

@@ -116,27 +116,13 @@ for i in $(seq 1 30); do
   sleep 1
 done
 
-# ── 6. Liquibase migrations ───────────────────────────────────────────────────
+# ── 6. Note on migrations ─────────────────────────────────────────────────────
 step "Database migrations"
-JDBC_URL="jdbc:postgresql://localhost:${DB_PORT}/${DB_NAME}"
-
-if [[ ! -f "$PROJECT_ROOT/pom.xml" ]]; then
-  warn "No pom.xml found — Maven project not scaffolded yet (WORKLOG Block 1 / C-00)."
-  warn "Skipping Liquibase migrations. Run this script again after completing Block 1."
-else
-  # apix-registry depends on apix-common and apix-verification; install them
-  # to the local repository first so Maven can resolve them during the
-  # liquibase:update goal (no source files yet — this completes in seconds).
-  info "Installing shared modules to local repository…"
-  mvn -q install -pl apix-common,apix-verification -DskipTests
-
-  info "Running Liquibase migrations on $JDBC_URL"
-  mvn -q liquibase:update -pl apix-registry \
-    -Dliquibase.url="$JDBC_URL" \
-    -Dliquibase.username="$DB_USER" \
-    -Dliquibase.password="$DB_PASS"
-  info "Migrations applied"
-fi
+# Migrations are applied automatically by Quarkus at startup via
+# quarkus.liquibase.migrate-at-start=true. Running them separately via the
+# Maven Liquibase plugin records a different classpath prefix in DATABASECHANGELOG
+# than Quarkus uses, causing a "relation already exists" conflict on next start.
+info "Migrations will run automatically when Quarkus starts (migrate-at-start=true)."
 
 # ── Done ──────────────────────────────────────────────────────────────────────
 echo ""