feat(operator): gate op.console to staff and land owner setup there

The operator console (op.console.<root>) requires internal permission
verification on top of Zero-Trust: a passkey is not access. requireExternal
now refuses any non-admin principal arriving on the admin host, before any
handler, so op.console is staff-only at the door rather than per-route —
including on the passwordless demo face where Cloudflare Access is not in
front. The gate is inert on the player console (console.<root>).

Owner first-run setup is staff onboarding, so `felis setup` mints the
one-time setup URL on op.console.<root>/setup (was console.<root>). The
passkey verifier lists both console and op.console in RPOrigins so the
one-time binding asserts on either face under the shared console.<root>
RP-ID.

Session admin-access now includes role=owner, not only admin: the owner is
a superset of admin, so excluding it left IsOwner() unreachable through a
passwordless session. No path assigns role=owner yet — this is forward
consistency.

The bootstrap summary now names console.<root> the player panel and
op.console.<root> the operator console where the Owner runs setup, fixing
text that told operators not to run setup there.

Tests: op.console door gate (non-admin refused, player console unaffected,
admin passes) and owner session admin-access; the setup-bind default-host
test follows the move to op.console.

internal/api/api.go

@@ -92,6 +92,14 @@ type API struct {
 	// never hardcoded.
 	RootDomain string
 
+	// AdminHostname is the operator console host (op.console.<root_domain>) from
+	// config. requireExternal refuses any non-admin principal that arrives on it,
+	// so op.console is staff-only at the DOOR — not merely per-route — even on the
+	// passwordless demo face where Cloudflare Access is not fronting it. Empty
+	// falls back to op.console.<RootDomain> (see hostIsAdminConsole). On the player
+	// console (console.<root_domain>) the gate is inert.
+	AdminHostname string
+
 	// WakeCooldown throttles repeated wakes per server (spec §9.1: cooldown hangs
 	// on the wake lever). Zero disables throttling.
 	WakeCooldown time.Duration