feat(capabilities): honest secret-presence downgrade + admin features view [operator §4]

Make /capabilities fail-closed and add the admin features surface.

- Secret-presence downgrade (§4.2): a chain whose flag is on but whose source is
  unconfigured (btc/ltc no electrum URL, xmr/wow no LWS admin key, grin no owner
  secret) now reports enabled:false — so /capabilities never advertises a chain
  that would 404, and a missing-secret downgrade is indistinguishable from a
  deliberately-off chain. grin_relay requires serviceable Grin; nostr_identity
  requires PUBLIC_API_URL. effective_capabilities() is the single explicit mapper.
- contract_version stamp on the public document (clients soft-notice a higher
  value, ignore unknown additive keys).
- GET /admin/features (admin_guard): the resolved effective state PLUS admin-only
  downgrade reasons (the public surface hides the reason, per §4.3).
- Golden test: the public capabilities JSON, built from a fully-secret-seeded
  config, contains no secret value (asserts no "integration-test-" substring).

openapi regenerated (contract_version). Admin features view stays off the public
OpenAPI.

Deferred (documented): runtime mutation — PUT /admin/features + a DB feature-
override table + resolve() precedence + Arc hot-swap + CLI `features set`. Flags
are env/config-driven for v1; runtime tuning (and its fleet propagation, itself a
deferred LB decision) is a later addition.

tests/capabilities.rs

@@ -12,6 +12,19 @@ async fn capabilities_is_public_and_well_shaped() {
     assert_eq!(status, StatusCode::OK);
 
     assert!(body["version"].as_str().is_some(), "version present");
+    assert!(
+        body["contract_version"].as_u64().is_some(),
+        "contract_version present"
+    );
+
+    // Golden: no server secret may appear in the public capabilities JSON. The
+    // harness seeds every secret with the "integration-test-" prefix.
+    let raw = serde_json::to_string(&body).unwrap();
+    assert!(
+        !raw.contains("integration-test"),
+        "no secret leaks into public capabilities: {raw}"
+    );
+
     // Every chain reports an `enabled` boolean.
     for chain in ["btc", "ltc", "xmr", "wow", "grin"] {
         assert!(