Add admin endpoint to create a custom-spec VM

[v0l]

Closes #335.

POST /api/admin/v1/vms/custom creates a VM from an arbitrary spec for any user, billed against a custom pricing plan. Previously the admin create path only accepted template_id, so an admin could not place the kind of order most customers actually make.

• Spec travels as one shared type, CustomVmSpec in lnvps_api_common/src/model.rs:741-802, with to_template() doing all the string→enum parsing. Admin route and worker call the same function, so the request cannot validate differently from the job.
• Unknown disk_type/disk_interface/cpu_mfg/cpu_arch/cpu_feature spellings are a 400 before any DB lookup, never a default (lnvps_api_admin/src/admin/vms.rs:1279-1284). The customer path defaults silently here; on the admin path a typo would be someone else's machine.
• New WorkJob::CreateCustomVm (lnvps_api_common/src/work/mod.rs:162-171) mirrors the existing CreateVm shape: async job, { job_id } response, log_vm_created with admin metadata (lnvps_api/src/worker.rs:2774-2820).
• Provisioning is unchanged: the worker calls the existing provision_custom, which already validates pricing enabled/expiry, image arch compatibility, spec range and host capacity (lnvps_api/src/provisioner/vm.rs:226-270). No new provisioning logic, and the VM is created unpaid like a customer order.
• POST /api/admin/v1/vms (template path) is untouched.

Open question from the issue — job queue vs. direct call — settled on the queue: it keeps the admin create shape ({ job_id }) consistent and the admin API has no provisioner.

Tests: unit tests for spec→template and the flattened request body (lnvps_api_common/src/model.rs:994-1065, lnvps_api_admin/src/admin/vms.rs:1441-1465); e2e in lnvps_e2e/src/admin_api.rs (unauthenticated → 403, bad spec values → 400) and the happy path in lnvps_e2e/src/lifecycle.rs:1648-1725, which asserts a new custom-template VM appears for the user. cargo test --workspace green at 307c644 (excluding lnvps_e2e, which needs the live stack); full e2e suite 167 passed in 16.5s via ./scripts/run-e2e.sh; clippy clean on the lines touched.

Docs: ADMIN_API_ENDPOINTS.md and API_CHANGELOG.md updated. Additive only — no response shape changed.

Originating channel: general (721a8a6c-c36c-5fa1-ae07-822ddc8567c5).