feat(admin): inspect selected startup configuration

[n30nex]

What this PR does

Add protected GET /api/v1/admin/config as the first read-only slice of #60. It reports selected startup settings: CORS options with Beacon defaults applied, whether auth is configured, and the number of configured broker workers. It never serializes the full Config/environment or exposes credential fields, broker addresses, channel material or internal paths. The CORS lists are copied at router construction and use the same resolved values passed to the middleware.

Authentication #146 is merged. This branch is rebased directly onto current dev (595ef44); its diff contains only the configuration-inspection slice and is ready for review.

Missing config still disables admin access with 503; invalid credentials return 401. Valid credentials can read this endpoint with Cache-Control: no-store. Public routes and CORS preflights remain unchanged. Configuration writes/account operations stay in later slices of #60; broker_count is an actual configured-broker count, not the proposed but nonexistent tunable worker_count setting. Swagger describes this operation's required Authorization header without adding global authentication to public endpoints.

Type of change

• New feature

• Tests

• Docs / config

Checklist

• go build ./... passes

• gofmt -l . is empty

• go vet ./... passes

• go test ./... passes

• New behavior has tests

• Swagger regenerated and generated docs committed

• No DB or dependency changes

• I have read CONTRIBUTING.md

Testing notes

Rebased after merged #140 onto dev at 595ef4442b5e535fdae9dedaf52480129bf61195. Validated head: 71054b0ca9e4e2a6fc5090c6536607a644f23080. Full Windows and native Pi 5 build/vet/format/tests pass, with private PostgreSQL integration tests enabled on the Pi. Focused Windows race checks, Actions build and CodeQL pass. Swagger was regenerated and is current.

The Pi preview changelog now marks #140 as merged. Its verified server 157fcee3 / web 166f7334 already contains the combined integration adjustments; it remains running with both MQTT feeds advancing and matching source identities. The individual PR revisions above were built and tested separately on the Pi.

AI-assisted implementation and testing under the contributor's standing authorization; submitted for maintainer review.

[n30nex]

@MrAlders0n please review this change with your Claude agent as part of the September 13 Beacon review batch. The current candidate is c63a085932ae; validation and Pi evidence are in the PR description.

Early review is requested on the config-only delta linked in the description. Keep this draft until prerequisite #146 is merged and the branch is rebased. Please check secret exclusion and agreement with effective CORS settings. Issue #60 remains open for the remaining scope.

[n30nex]

@MrAlders0n Rebased onto the current merged dev; ready for your/Claude's review at 9c685c62. Full Windows and native Pi 5/PostgreSQL checks, focused race checks, and Actions build/CodeQL pass. Auth #146 is merged, so this is now ready for review with only the config-inspection delta.

[n30nex]

@MrAlders0n Updated at 71054b0c on dev 595ef44 after #140. Rebase preserves the merged REST limiter/auth and the config-inspection endpoint. Full local and native Pi/PostgreSQL checks, focused race checks, and Actions/CodeQL pass. Ready for your/Claude's recheck; the running preview remains healthy and its changelog records merged #140.