v0.82.0: the admin extension seams

The admin extension surface for sites that build their own /admin/ screens, proven by the
aksailingclub-org club-admin scaffold before it shipped. No Consumers must: lines: the whole
window is additive.

Engine (admin extension seams; no consumer action)

• @glw907/cairn-cms/admin-fields (new subpath): the admin field-renderer primitives a
  custom /admin/ screen composes instead of hand-rolling worse copies — SelectField,
  TextField, and the shared FieldLabel wrapper. Deliberately small; grows one real
  consumer at a time.
• OfficeList joins components: the header-plus-card shell every triage-table screen
  composes, lifted from ConceptList.
• adminAction joins sveltekit: wraps a custom admin action with the engine's editor,
  CSRF, and audit contract. The CSRF check is defense-in-depth (the guard already enforces it
  on every /admin/** POST); the wrapper's real job is the typed ctx.editor and the
  REQUIRED audit emit — a zero-emit mutating action throws in dev and logs the new
  admin.action.unaudited event in production. Every emit logs admin.action.audited.
• adminNav sections: an AdminNavSection (label + flat children) renders as its own
  collapsible sidebar group beside Core. Existing flat configs need no changes.
• navFilter on ContentRoutesDeps (and forwarded through CairnAdminDeps): a
  per-request filter over the custom nav, run after the engine's own role filter, so a site
  whose authorization lives in its own store can hide a section instead of teasing a link
  that 403s.