feat: add guarded admin reset endpoint

[alan-provable]

Summary

Closes #162.

Adds a guarded POST /api/v1/admin/reset maintenance endpoint for local tests and demos. The endpoint is disabled by default, only enables when ALLOW_ADMIN_RESET is explicitly set to true, 1, yes, or on, emits an admin.reset audit event before clearing state, and returns a summary of the process-local stores it cleared.

The reset covers usage counters, service registry state, service metadata, disabled-service flags, API keys, webhooks, audit events, rate buckets, pause state, and runtime config. The README documents the destructive behavior and the production safety expectation.

Validation

• git diff --check origin/main..HEAD
• npm run build
• npm run lint
• npm test passed with 93 tests, run with local-listen permission for Supertest ephemeral ports

Safety note

The endpoint remains unavailable unless the explicit environment flag is enabled. When disabled, it returns the existing 404 not_found shape rather than exposing an active reset surface.