feat(desktop): in-app admin console for relay operators

[wpfleger96]

Adds an in-app admin console for relay operators, surfaced as an "Admin console" section under Settings. Operators view deployment-wide moderation reports and product feedback, resolve or dismiss reports, update feedback status, and manage the operator/moderator staffing roster — all authenticated with the operator's own Nostr key over NIP-98, with no browser extension or bearer token.

Discovery and connection

• On mount, the console fetches the connected relay's NIP-11 information document and reads the optional admin_api field to auto-discover the admin origin — zero manual input on the happy path.
• The advertised origin is untrusted input: it is revalidated through AdminOrigin::parse before use, and an absent or invalid value falls back to a manual origin field (pre-filled when discovery succeeds).
• A saved manual origin takes precedence over discovery — an operator's explicit choice is never overridden.

Auth and transport (Rust, src-tauri/src/commands/admin/)

• AdminOrigin value object: validates scheme + host + optional port, rejects credentials, path, query, and fragment; http:// only for loopback hosts, https:// otherwise.
• AdminRoute closed enum: no IPC surface accepts arbitrary URLs or paths, so the NIP-98-signed URL is byte-identical to the fetched URL.
• Dedicated no-redirect reqwest client as an SSRF guard: a relay 3xx is surfaced as an error and the NIP-98 header is never forwarded across origins.
• admin_probe returns a typed state (Nip98Authorized / Denied, TokenMode, Disabled, NotAdminApi, NetworkOrIntercepted); Nip98Authorized only on an authenticated 2xx.
• NIP-98 signing via AppState::signing_keys() (errors cleanly in recovery mode), with one retry on 401 using a fresh signed event.
• Response size bounded by a Content-Length preflight and a streaming byte counter; per-pubkey origin storage with atomic 0o600 writes.

Console UI (TypeScript, src/features/admin-console/)

• AdminConsoleSettingsCard: discovery + probe flow, per-pubkey state, role and source badges when authorized, honest copy for every probe state.
• AdminConsolePanel with Reports / Feedback / Staffing tabs (Staffing gated on role === "operator").
• Reports: full action matrix per target_kind (event → delete/kick/ban/timeout/dismiss/escalate; pubkey → ban/timeout/dismiss/escalate; blob → dismiss/escalate). Enforcement state renders processing as not-actionable and pending/enforcing/succeeded/failed with retry; cancel is offered only pre-mutation, and a rejected cancel is treated as server-authoritative. Each attempt carries a client-generated request_id, reused on retry after a lost response.
• Feedback: list, detail, and status control (new/reviewed/archived) with a generation-fenced attachment viewer (image/* auto-loads; other MIME types load on demand).
• Staffing: add operator (pubkey + role), roster with config / owner_fallback / db source badges; config-backed entries disable remove client-side and surface a 409 conflict as a human-readable message.

Settings refactor

• SettingsPanels.tsx split along panel boundaries (ThemeSettingsCard.tsx extracted) to stay under the 1000-line file-size ratchet; the PTT global-shortcut plugin builder is extracted from lib.rs for the same reason. Mechanical, no behavior change.

UI invariants

• processing reports are never presented as actionable.
• Post-mutation delivery states render on a resolved report, never as an enforcement failure.
• token and disabled auth modes render read-only, with no action or staffing capabilities.

Related: #3777 (relay OPERATOR/MODERATOR role model + NIP-98 auth + admin_api NIP-11 advertisement — provides the runtime and the discovery field this console consumes)
Related: bb-public#339 (Phase 4 rollout config)