admin: rate-limit + audit emit + access-log prefix scrub (defense-in-depth layers 3-5)

[mastermanas805]

Summary

Three new defense-in-depth middleware layers on top of the existing
ADMIN_PATH_PREFIX (gate 1) + ADMIN_EMAILS (gate 2):

• AdminRateLimit (gate 3): 30 req/min/fingerprint cap via Redis sliding
  window. Excess returns 403 (NOT 429) with a body byte-for-byte
  identical to the RequireAdmin allowlist-miss 403, so probes can't tell
  which gate denied them. Runs BEFORE RequireAdmin so invalid-JWT probes
  also burn slots. Fail-open on Redis errors.
• AdminAuditEmit (gate 4): writes an admin.access audit_log row on
  EVERY hit — success AND 403. Captures email, ip, path_suffix,
  http_status, user_agent_brief, denied_by. path_suffix strips
  the secret prefix — the prefix MUST NOT land in audit_log.
• LogScrubber (gate 5): slog handler wrapper replacing every occurrence
  of ADMIN_PATH_PREFIX with the literal <ADMIN> in string attributes
  and message bodies. Wired in main() outside of logctx.NewHandler so
  the scrub runs LAST. Empty prefix → pass-through, zero overhead.

Chain order on the admin group:

AdminRateLimit -> AdminAuditEmit -> RequireAdmin -> handler

Audit sits BEFORE RequireAdmin because RequireAdmin returns 403 directly
on rejection (no c.Next) — any middleware after would never see the
rejection path. Audit's internal c.Next() drives the rest of the chain
and observes the final status either way.

New audit kind: models.AuditKindAdminAccess = "admin.access".

Test plan

Tests in same PR. make test-unit green across all packages, including
TestAgentActionContract.

• log_scrubber_test.go — 9 cases: URL attr scrub, message body scrub,
  empty-prefix passthrough, non-string attrs untouched, nested slog.Group,
  JWT-pattern regression check, free-function helper.
• admin_rate_limit_test.go — 4 cases: 31st req returns 403,
  byte-for-byte body parity with allowlist-miss 403, fail-open on Redis
  down, fingerprint-independence (A's exhaustion doesn't affect B).
• admin_audit_test.go — 5 cases: success writes row with full
  metadata, rate-limited 403 writes row with denied_by=rate_limit,
  allowlist-miss writes row with denied_by=allowlist_miss, path-suffix
  strip helper unit test, metadata no-prefix invariant assertion.

Iron-rule verification

The audit_log metadata MUST NEVER contain the admin prefix string. Every
audit test asserts this via assert.NotContains(t, raw, prefix, ...)
against the persisted metadata blob. A dedicated AdminAuditEnsureMetadataNoPrefix
helper is exported for cross-package regression checks.

The 403-for-rate-limit / 403-for-allowlist-miss body parity is enforced
by TestAdminRateLimit_403MatchesAllowlistMiss_ByteForByte with a strict
bytes.Equal check on the two response bodies.

🤖 Generated with Claude Code