[P1][Post-0.5][Full C] Add platform-operator fleet controls, audit, and observability

[mightnent]

Parent epic: #82

Outcome

Give platform operators a safe, audited fleet view and bounded controls for capacity, identity, assignment, drain, replacement, and recovery without exposing private node or infrastructure material to tenant sessions.

Execution

• Priority: P1 post-0.5 Full C operations.
• Deployment profiles: Hosted required.
• Worktree boundary: Platform-operator APIs/UI, step-up authorization, audit, metrics, alarms, runbooks, and focused browser/security tests. Avoid customer-facing placement controls and cloud-specific console replacement.

Scope

• Show logical node ID/label, placement class, dedicated tenant if any, attachment summary, admission, observed health, last heartbeat, version, capacity, assignments, and active workspace count.
• Expose provisioning attempts and actionable secret-free failure reasons.
• Support request capacity, register/import, rotate credentials, drain, disable, replace, assign/reassign future workspaces, and initiate a cold migration through bounded backend contracts.
• Require recent step-up authentication and an audit reason for sensitive or ownership-changing actions.
• Preview affected tenants/workspaces before destructive or ownership-changing operations.
• Add metrics, alarms, and runbooks for stale/offline nodes, low capacity, provisioning failure, version skew, credential expiry, reconciliation backlog, duplicate ownership, and purge failure.

Non-goals

• Customer or tenant access to fleet placement controls.
• Displaying credentials, private keys, private endpoints, certificate inventory, or raw cloud metadata.
• Reimplementing a cloud provider console in LemmaComputer.

Definition of success

• Operators can identify the logical node and infrastructure attachment serving every tenant/workspace and see current health/capacity/version.
• Sensitive actions require current step-up authentication, show impact, require a reason, and emit complete audit records.
• Customer and tenant sessions cannot access fleet operations or private node/infrastructure metadata.
• Metrics, alarms, rollback, credential rotation, drain, replacement, and node-removal runbooks are exercised.
• Focused operator authorization/store/API tests, npm run verify:db, relevant platform-operator Playwright coverage, and npm run verify:quick pass on the exact candidate SHA.