feat(namespace): add admin namespace management

[XiaoSeS]

Summary

This PR implements a complete admin namespace management flow instead of only making SUPER_ADMIN see more data in /me/namespaces.

It addresses the product gap behind #580: platform admins need a dedicated backend console to inspect and govern all namespaces, while /api/v1/me/namespaces should continue to represent real namespace membership for normal user flows.

What changed

• Add SUPER_ADMIN-only admin namespace APIs under /api/v1/admin/namespaces.
• Add admin namespace list/detail read model with member and skill counts.
• Add platform-admin member governance: candidate search, add, batch add, role update, remove, ownership transfer.
• Add platform-admin lifecycle governance: freeze, unfreeze, archive, restore.
• Keep system namespaces immutable for member mutation.
• Fix /api/v1/me/namespaces semantics so it only returns actual membership, not platform override visibility.
• Add /admin/namespaces frontend page with filters, detail panel, member operations, lifecycle actions, and admin menu entry.
• Regenerate OpenAPI types.

Validation

Local source validation:

• make generate-api passed.
• git diff --check origin/main...HEAD passed.
• make typecheck-web passed.
• make lint-web passed.
• Backend app regression passed in Java 21 container: 739 tests, 0 failures, 0 errors, 1 skipped.

Runtime validation:

• Built exact-SHA local Docker images for server and web.
• Started release-like Compose preview with local exact-SHA server/web images and reused scanner image.
• Verified runtime business scenarios:
  • admin login
  • admin creates a team namespace
  • admin list/detail/member APIs
  • member candidate search
  • add member
  • update member role
  • normal user /me/namespaces visibility before and after membership
  • freeze/unfreeze/archive/restore
  • global namespace member mutation rejected with 400
  • non-super-admin admin API access rejected with 403

Out of scope

• No Dockerfile, Compose, Kubernetes, or release-runtime configuration changes.
• No Hong Kong official-image validation is required by this PR because deployment chain files are not changed.
• No new namespace creation UI beyond the existing user-facing namespace creation flow.

Closes #580.