[Backend] Expose admin permissions, capabilities, and diagnostics APIs

[juliuskrah]

Related admin initiative: #287
Blocks admin issues: #290, #299, #301

Summary

Expose backend APIs that the commerce admin can use for viewer permissions, capability discovery, configuration state, and diagnostics.

Acceptance criteria

• gitstore-api exposes a current-viewer or capability query suitable for route guards and permission-sensitive admin screens.
• Capability responses identify namespace-scoped permissions for catalog, media, basket, checkout, customer/profile, settings, and diagnostics workflows without exposing secrets.
• Diagnostics responses cover API health, schema/version/codegen-relevant metadata, enabled backend capabilities, and degraded/unavailable states.
• Configuration responses redact secrets and distinguish missing configuration from unauthorized access.
• Auth, authorization, and degraded-service errors are structured for admin UI mapping.
• Tests cover authenticated, unauthenticated, unauthorized, redacted, degraded, and namespace-scoped capability cases.

Architecture note

The commerce admin remains an optional add-on and consumes gitstore-api; it must not talk directly to gitstore-git-service. In admin workflows, a namespace is the store context.