feat: reserve Doris administration domain

[FreeOnePlus]

Summary

• Reserve a fail-closed Doris administration domain contract without registering any administration tool, resource, prompt, handler, or write path.
• Model explicit risk levels, scopes, preview/execute phases, single-use confirmation, argument digests, idempotency, and rollback pairing for future administration capabilities.
• Keep the reservation disabled in 1.0.0 and reject configuration that attempts to enable it or bypass confirmation.
• Document the operator-facing configuration boundary and update CHANGELOG.md under Unreleased.

Validation

• Focused reservation and exposure regression: 65 passed
• pytest -W error -q: 1730 passed, 81 skipped; 67.44% coverage
• uv lock --check
• uv run ruff check .
• uv run mypy doris_mcp_server
• uv run bandit -q -c pyproject.toml -r doris_mcp_server
• uv build
• Real Doris 4.0.5-rc01 acceptance over stdio/HTTP and hierarchical/flat exposure: all four cases passed
• Administration tools, resources, and prompts discovered: 0
• Guessed doris_admin and doris_admin_cancel_query calls: stable TOOL_NOT_FOUND
• Administration write operations executed: 0