feat(capabilities): honest secret-presence downgrade + admin features view [operator §4]

Make /capabilities fail-closed and add the admin features surface.

- Secret-presence downgrade (§4.2): a chain whose flag is on but whose source is
  unconfigured (btc/ltc no electrum URL, xmr/wow no LWS admin key, grin no owner
  secret) now reports enabled:false — so /capabilities never advertises a chain
  that would 404, and a missing-secret downgrade is indistinguishable from a
  deliberately-off chain. grin_relay requires serviceable Grin; nostr_identity
  requires PUBLIC_API_URL. effective_capabilities() is the single explicit mapper.
- contract_version stamp on the public document (clients soft-notice a higher
  value, ignore unknown additive keys).
- GET /admin/features (admin_guard): the resolved effective state PLUS admin-only
  downgrade reasons (the public surface hides the reason, per §4.3).
- Golden test: the public capabilities JSON, built from a fully-secret-seeded
  config, contains no secret value (asserts no "integration-test-" substring).

openapi regenerated (contract_version). Admin features view stays off the public
OpenAPI.

Deferred (documented): runtime mutation — PUT /admin/features + a DB feature-
override table + resolve() precedence + Arc hot-swap + CLI `features set`. Flags
are env/config-driven for v1; runtime tuning (and its fleet propagation, itself a
deferred LB decision) is a later addition.

openapi.json

@@ -1719,6 +1719,7 @@
         "type": "object",
         "required": [
           "version",
+          "contract_version",
           "chains",
           "features"
         ],
@@ -1726,6 +1727,12 @@
           "chains": {
             "$ref": "#/components/schemas/ChainCapabilities"
           },
+          "contract_version": {
+            "type": "integer",
+            "format": "int32",
+            "description": "Capabilities contract version (additive changes do not bump it).",
+            "minimum": 0
+          },
           "features": {
             "$ref": "#/components/schemas/FeatureCapabilities"
           },