Harden admin authorization readiness

[16francej]

What changed

• Retry and bound the admin surface's core authorization lookup, including final failure diagnostics.
• Keep the portal's outer authorization probe alive long enough for that downstream retry budget.
• Add a short-lived synthetic non-admin portal smoke check and run it from the portal workload during Fly and AWS live readiness checks.
• Add regressions for the missed admin bootstrap boundary and both deployment runners.
• Bump the CLI package to 1.0.6 because the deployment backends ship in @yc-software/qm.

Root cause

The previous retry protected only the portal's initial admin gate. After the shell loaded, the admin SPA called /admin/api/me, whose separate admin-to-core authorization lookup was one-shot and unbounded. A transient failure there produced the “Admin is temporarily unavailable” screen even though the portal gate had succeeded.

Deployment checks also stopped at generic health, ingress, and private core session checks, so they never traversed the public portal → admin → core authorization path.

Impact

Transient core failures during admin bootstrap are retried within a bounded budget. Persistent failures still fail closed, return the existing unavailable state, and now emit actionable diagnostics. Fly and AWS live checks will catch a broken public admin authorization chain without a real user session or a public bypass endpoint.

Validation

• npm --prefix plugins/admin test — 79 passed
• npm --prefix plugins/portal test — 109 passed
• CLI test suite — 516 passed
• npm run typecheck
• admin and portal package typechecks
• npm run lint
• npm run format:check
• Live local browser test with real portal and admin servers: the portal gate succeeded, the SPA's second authorization hop received a transient 502, retried, and rendered the signed-in Admin UI