v5.0.0: operator control plane

The gateway gains a bearer-token admin API under /admin, disabled until admin_token is configured (the shipped config reads FAILSAFE_ADMIN_TOKEN and treats an unset variable as disabled rather than a literal secret). GET /admin/upstreams lists every replica with health, breaker state, ejection, draining flag, concurrency limit and recent error rate; the eject (optional seconds), readmit, drain, undrain and reset-breaker actions act on one replica through the same pool paths the outlier detector uses. POST /admin/drain withdraws readiness while the gateway keeps serving, so an instance can leave a load balancer gracefully. New metrics for draining replicas and admin actions. 108 tests.