feat(admin): install, update, configure, and remove server apps

[veryCrunchy]

Parent: #185

Provide a native administration surface for the complete server-app lifecycle.

Scope

• browse installed, disabled, available, incompatible, and updateable apps
• search and filter the official app catalog with compatibility and trust information
• install, enable, disable, update, repair, and remove apps through verified operations
• show dependencies, version constraints, signatures, licenses, release notes, permissions, and maintenance impact
• expose app-specific administration settings through typed reusable controls when a verified settings contract is available
• track long-running operations and recover safely after interruption

Safety and acceptance

• the normal user Apps view remains separate from administration
• actions are disabled when permissions, compatibility, signatures, dependencies, or maintenance requirements are not satisfied
• removal and breaking upgrades require clear data-retention and service-impact confirmation
• package contents and arbitrary server output never become executable client UI
• tests cover incompatible versions, dependency failure, signature failure, interrupted update, rollback/recovery messaging, stale catalog state, and multi-account isolation