Replace the untyped ctx.adminContext bag with a typed, optional capability registry #97

Problem

Core and the admin plugin communicate through BootstrapResult.adminContext, a Record<string, unknown> | null that plugin-admin fills and core reads with casts. Core reads it in four files:

• src/cli/serve.ts: writes jobScheduler, reads the scheduler and executeScheduledAction
• src/runtime/register-feeds.ts: staging (staged-content preview in feeds)
• src/runtime/register-middleware.ts and src/runtime/server.ts: auth (admin-session detection for role-gated pages)

It is untyped, so the shape is an unwritten contract that would be frozen at 1.0 by accident. It also hides which public behaviour depends on an admin being present.

Proposal

A typed, optional capability registry owned by core. An admin (or any plugin) contributes capabilities through typed slots (staging, auth / session resolver, jobs, and whatever else the audit finds); core reads them with proper types and treats a missing slot as "feature absent". "No admin" then just means "no contributions". adminContext is removed, not kept as an alias (deprecated bits are gone by 1.0).

Notes

• Breaking for @dune/plugin-admin, which fills the bag today: ships in 0.36 with an admin major.
• Feeds the @dune/plugin-api contract: the slot types belong in it.
• Acceptance: the headless smoke test (admin off) keeps passing, and a test with a stub plugin contributing each slot shows core using it.
• Part of the pre-1.0 list; related to Design: a versioned @dune/plugin-api contract to end pin drift and make admin replaceable #64.