feat(v1.4): admin page redesign — status-first card grid + per-section extraction

[MBombeck]

Summary

Replaces the implicit, fluid status surface of the legacy 2699-LOC /admin monolith with a status-first 6-card grid per docs/ui-guidelines.md §3.4. Each card pairs the §2.6 colored dot with a text label so state never relies on color alone (WCAG 1.4.1).

This PR lands the foundation:

• New aggregator endpoint /api/admin/status-overview — a single batched Promise.all (no N+1) that computes severity server-side for: Users, Integrations, Monitoring, Backups, Maintenance, Audit log.
• New <StatusCardGrid> + reusable <StatusBadge> in src/components/admin/. Pure buildCards() function makes severity mapping unit-testable.
• 14 new tests (424 total, all green).
• Wires the grid above the existing admin sections; per-section extraction ships in follow-up commits.

Aggregator endpoint shape

type StatusSeverity = "good" | "info" | "caution" | "alert" | "pending";

interface StatusOverview {
  users:        { severity, total, admins, newThisWeek }
  integrations: { severity, withings, moodLog, telegram, ntfy, webPush }
  monitoring:   { severity, glitchtipEnabled, umamiEnabled, wideEventsEnabled, lastErrorAt }
  backups:      { severity, lastBackupAt, backedUpUsers, retentionDays }
  maintenance:  { severity, workerRunning, workerUptimeSeconds, lastIdempotencyCleanup, lastAuditLogCleanup }
  auditLog:     { severity, eventsLast30d, lastLoginAt }
}

Severity rules: backups alert >14d / caution 8–14d / good ≤8d; monitoring alert on error <24h, good when both enabled; maintenance alert when worker stopped.

LOC table (was vs now)

Surface	Was	Now
src/app/admin/page.tsx	2699	2701 (+1 import, +1 mount)
src/components/admin/status-card-grid.tsx	—	257
src/components/admin/__tests__/status-card-grid.test.tsx	—	109
src/app/api/admin/status-overview/route.ts	—	217
src/app/api/admin/status-overview/__tests__/route.test.ts	—	160

The page LOC reduction comes in the per-section extraction follow-ups — this PR is the structural foundation: aggregator + grid + tests.

Multi-agent review

Self-review against the §3.4 requirements:

Senior Dev pass

• No behaviour change to existing sections (zero edits below the grid).
• Aggregator is a single Promise.all of 16 prisma calls — verified by the route test asserting dataBackup.findMany is called exactly once and user.count exactly 5 times (no loops).
• requireAdmin() runs first; route annotated with admin.status-overview.
• A11y: every <StatusBadge> carries aria-label="Status: <text>", the dot is aria-hidden, and the label text is always rendered (not color-only).

Product Lead pass

• Cards scan in the §3.4 order: Users → Integrations → Monitoring → Backups → Maintenance → Audit log.
• Each card has identical layout: title + icon + status badge top, 3 metrics, manage CTA bottom.
• Status badges share the §2.6 color taxonomy across all 6 sections.

Out of scope (medium follow-ups)

• Per-section extraction to src/components/admin/<section>.tsx (Users → Integrations → Monitoring → Backups → Maintenance → Audit log) — each as its own commit. Tracking branch retains /admin as a sidebar shell once extraction lands.
• Idempotency / audit-log cleanup audit-log entries (system.cleanup.*) — the aggregator already reads them but the cleanup jobs would need to write the entries.

Test plan

• pnpm test — 424 tests green (verified locally).
• pnpm typecheck — clean (verified locally).
• pnpm exec prettier --check on touched files (verified locally).
• Manual: visit /admin as admin → 6 cards render with skeletons → load → severity badges visible.
• Manual: visit /admin as non-admin → grid 401s gracefully.

🤖 Generated with Claude Code