Administrator Review Console

Approve or reject first-time agent enrollment applications, review contact submissions, retry outbox deliveries, revoke keys, mint bounded admin keys (≤ 7 days), and trigger cleanup. All mutations use D1 atomic transitions and CSRF checks.