Build server-rendered ZITADEL administration UI

## Outcome Deliver an accessible, server-rendered administration UI for the Rust identity service so authorized operators can inspect and safely modify production-compatible identity data and disposable test environments without direct SQL or legacy ZITADEL APIs. ## Scope - Authenticate administrators through durable database-backed browser sessions, with explicit account selection and real logout. - Provide a localized administration shell and dashboard for the configured instance. - Manage organizations, projects and OIDC applications, including exact redirect URIs and post-logout redirect URIs needed by relying parties and local test environments. - Manage human users through the existing application service: search, inspect, create, edit profile/contact/username, set/reset credentials where authorized, and remove. - Inspect and manage machine/service users and personal access tokens, showing newly generated secrets once and never storing or logging plaintext. - Inspect and update the supported login, password, email/notification and branding policies required for production operation. - Provide immutable audit/event history with actor, resource, event type, time and safe payload summaries. - Support English (`en`), Norwegian Bokmål (`nb`) and Danish (`da`) with identical catalog keys. ## Architecture and constraints - Askama SSR and normal HTTP forms are the baseline; essential administration must work without JavaScript. - Extend `identity-domain` and `identity-application` with transport-independent admin models, commands, queries, authorization and transactional interfaces. Keep business decisions out of Axum handlers and templates. - Reuse and extend the existing `UserService`, login/session infrastructure, permission resolver, CSRF/security headers, localization and Postgres transaction patterns. Do not build parallel user or authorization implementations. - Scope every lookup and mutation to the configured instance, then authorize against the resource's actual organization/project owner. Cookies may identify a session but never carry trusted permissions. - Recheck session validity, resource ownership, permissions, expected sequence and sensitive proofs inside the write transaction. Use Post/Redirect/Get and conflict-safe forms. - Persist immutable pinned-Go-readable events and synchronized required projections atomically. Add no migrations, application-owned tables, raw projection-only edits or mixed Go/Rust writers. - Treat PATs, client secrets, password data, session credentials and key material as redacted secret types. Never put secrets in URLs, templates after first display, logs or error bodies. - Destructive or credential-sensitive operations require explicit confirmation and recent authentication where appropriate. - Do not add SAML, SCIM, actions, quotas, arbitrary SQL/event editing, or legacy `/admin/v1`, `/management/v1`, `/auth/v1`, v1/v2beta/v3alpha APIs. ## Delivery stages 1. Admin authentication foundation: purpose-appropriate reusable password/session command, signed session selection cookie, per-request database validation and permission checks, CSRF, logout, localized responsive shell and dashboard. 2. Read-only resource explorer: instance status/fingerprint, organizations, users, projects/OIDC apps, service/PAT metadata, effective policies and paginated audit history. Establish shared navigation, pagination, filters, empty/error states and permission-aware actions. 3. High-value mutations: reuse user commands and add Go-compatible organization/project/OIDC application commands, especially redirect and post-logout URI management. Verify every write through restored fixtures and pinned-Go readback. 4. Credential administration: machine users, PAT create/revoke, client-secret lifecycle and direct human password actions with one-time secret display and explicit reauthentication. 5. Policy and presentation: supported login/password/email settings and branding/assets, including inheritance/default visibility and localized validation. 6. Production validation: role matrix, no-JavaScript browser flows in all locales, concurrency/rollback/security tests, real test-environment workflows, pinned-Go same-database readback, and operator documentation. ## Acceptance criteria - An authorized operator can sign in, choose an account, navigate the admin UI, sign out, and cannot reuse a terminated/expired/foreign browser session. - Instance owners and organization/project administrators see only resources/actions allowed by synchronized ZITADEL permissions; denied actions fail before sensitive work and are rechecked transactionally. - Operators can perform the production-required organization, user, project/OIDC app, service/PAT, policy and branding workflows without direct database access or JavaScript. - OIDC redirect and post-logout URI forms validate secure origins and exact compatibility semantics while allowing explicit loopback development URIs only where the stored client configuration permits development mode. - Every mutation emits compatible immutable audit events and keeps canonical projections/uniqueness state atomic; pinned Go reads Rust-written state after an exclusive-writer restart and the schema fingerprint remains unchanged. - PAT/client secrets are displayed once, remain redacted elsewhere, and are covered by revocation, authorization and logging tests. - Audit pages are read-only, instance-scoped, paginated and redact secret-bearing payload fields. - All user-facing strings exist in `en`, `nb` and `da`; keyboard, focus, labels, validation summaries and contrast receive browser coverage. - Workspace formatting, strict Clippy, unit/application tests, restored-fixture suites, role-specific no-JavaScript browser tests and relevant pinned-Go differential tests pass. ## Current implementation milestone - Verified durable signed admin session selection with per-request database validation, account choice, CSRF, logout, localized SSR shell/dashboard and no-JavaScript route coverage. - Verified same-account password step-up for credential, redirect and destructive workflows: sensitive forms remain hidden until fresh authentication, successful verification creates a new session and terminates the selected old session, failed verification retains it, signed cookies rotate, and return destinations are constrained to local `/admin` paths. - Verified permission-scoped SSR exploration for organizations, human/machine users, projects, OIDC applications, PAT metadata, effective policies and redacted audit metadata against the production-format fixture. - Verified localized organization creation for instance-scoped `org.create` administrators: the pinned generated primary domain, creator `ORG_OWNER` membership, five compatible events, uniqueness constraints and four synchronized projections commit atomically. Invalid, duplicate, concurrent and denied writes are covered; the schema stays unchanged and pinned Go reads the organization before exchanging a code for its Rust-created confidential client. - Verified admin human create/profile/contact/password/remove flows through the reused UserService; user mutations now recheck synchronized permissions inside their event/projection transaction. - Verified exact OIDC redirect/post-logout replacement with secure/loopback validation, optimistic sequence checks, compatible events, atomic projections and unchanged schema. - Verified PAT create/revoke with recent authentication and explicit confirmation; generated values are encrypted before persistence, shown only in the creating POST response and redacted thereafter. - Verified project creation and public/confidential authorization-code OIDC application creation through transport-independent commands and localized no-JavaScript forms. - Verified compatible `project.added`, `project.application.added`, `project.application.config.oidc.added` and client-secret rotation events, synchronized projections/unique constraints, configured 64-character secret generation and pinned `$2a$04$` hashing. - Verified one-time client-secret display, immediate rotation invalidation, recent-authentication/confirmation safeguards, stale-sequence rejection, duplicate-name races, cross-tenant denial, schema stability and pinned-Go confidential code exchange on disposable October-fixture clones. - Remaining scope: broader project/OIDC lifecycle commands; machine-user creation/edit; policy/branding mutations; complete browser role/accessibility and operator-documentation gates. ## Administration milestone The bounded minimum administration release is complete, including organization creation and practical test-environment OIDC redirect/logout configuration. Broader project/application lifecycle, machine users, policy/branding writes and the remaining role/accessibility/operator gates remain future administration scope. ## Explicit sequencing decision Invite/password-reset delivery is the next owner-defined cutover blocker, followed by passkey management/login. Broader administration work remains tracked here but does not precede those blockers unless explicitly reprioritized.