server: admin-credentials REST + Slot:admin push helper

Adds GET/PUT/DELETE /api/hosts/{id}/admin-credentials handlers that
mirror the existing repo-credentials endpoints but write to
store.CredKindAdmin with AEAD additional-data "host:<id>:admin" (scoped
away from the repo slot to prevent cross-binding). PUT immediately pushes
a config.update(Slot:"admin") to the agent when it is connected, and the
new pushAdminCredsToAgent helper is wired for use by the upcoming prune
run-now endpoint (D2) to push on-demand before dispatch.

internal/server/http/server.go

@@ -105,6 +105,13 @@ func (s *Server) routes(r chi.Router) {
 		r.Get("/hosts/{id}/repo-credentials", s.handleGetHostCredentials)
 		r.Put("/hosts/{id}/repo-credentials", s.handleSetHostCredentials)
 
+		// Admin credentials — the prune-capable slot (separate from the
+		// everyday repo creds). Optional: hosts that don't prune against
+		// a rest-server repo with a separate admin user never need this.
+		r.Get("/hosts/{id}/admin-credentials", s.handleGetAdminCredentials)
+		r.Put("/hosts/{id}/admin-credentials", s.handleSetAdminCredentials)
+		r.Delete("/hosts/{id}/admin-credentials", s.handleDeleteAdminCredentials)
+
 		// Per-host schedule CRUD. Mutations bump host_schedule_version
 		// and async-push to a connected agent (see schedule_push.go).
 		r.Get("/hosts/{id}/schedules", s.handleListSchedules)