Phase A3 — last big backend gap before admin-ui pages can drive every
feature the kit exposes.

## admin-api: 4 new controllers

PolicyAdminController (/admin/api/v1/policies)
- GET /                  list registered Policy bean names
- POST /{name}/test      dry-run evaluate with a PolicyContext, returns
                         ALLOW / DENY / NOT_APPLICABLE
- DefaultPolicyEvaluator gains registeredNames() for the listing path.

SettingsAdminController (/admin/api/v1/settings)
- GET /                  read-only view of devslab.kit.* properties
- Sensitive fields (jwt.secret) masked with "***".
- Implemented against Environment rather than DevslabKitProperties to
  keep the dependency graph acyclic (admin-api must not depend on
  autoconfigure, which already depends on admin-api).
- Mutating settings at runtime needs RefreshScope / external config;
  deliberately out of scope.

DiagnosticsController (/admin/api/v1/diagnostics)
- POST /login-test       run LoginCommand through LocalLoginService;
                         returns success + reason; note this does
                         increment the lockout counter, so admins
                         should be careful using it as a probe.
- POST /permission-check {userId, permissionCode} -> {allowed, userPermissionCodes}
- GET  /menu-visibility?userId=  filter the user's tenant's menu tree
                         by the permission codes that user actually has
                         (uses MenuTreeBuilder + manual filter rather
                         than PermissionBasedMenuFilter so it doesn't
                         hijack the current SecurityContext)

TenantAdminController (already shipped in PR #12) sits alongside these.

## autoconfigure: MetricsAutoConfiguration

Per planning §13. Listens to identity events and increments
Micrometer counters with tenant + reason tags:

  devslab.identity.login.success {tenant}
  devslab.identity.login.failure {tenant, reason}

Activated by @ConditionalOnClass(MeterRegistry.class). Consumer apps
that ship spring-boot-starter-actuator get the counters at
/actuator/metrics/{name}; apps that don't pull Micrometer skip the
listener entirely.

Registered in AutoConfiguration.imports.

micrometer-core added as compileOnly to autoconfigure so we don't
force the dep on apps that don't want metrics.

Verified: ./gradlew :devslab-kit-sample-app:test  -> BUILD SUCCESSFUL in 1m 8s
- All 4 new controllers wire
- MetricsAutoConfiguration activates (actuator is on sample-app's classpath)
- All previous beans, login flow, tenant CRUD still green