feat(api): Admin work-item list, detail and live SSE stream #279

Parent

#276

What to build

An admin can see the work queue and follow it live:

• a paged list of work items, filtered by status and kind;
• each item's detail;
• a Server-Sent Events stream that pushes every item whose state or progress changed.

This is the API that the future Anichron.UI admin view reads to draw progress bars: determinate when a total is known, indeterminate otherwise.

Acceptance criteria

• GET /api/v1/admin/work-items (admin role only), filtered by status and kind, paged, newest first. Each item shows:
  • kind, scope (config id), requester or "scheduled", status, attempt;
  • claiming worker and timestamps;
  • the progress snapshot (done, total or null, note).
• GET /api/v1/admin/work-items/{id} returns the item, or 404.
• Results by end state:
  • Succeeded: the Result summary;
  • Failed: the error and the last progress snapshot, with no partial results;
  • Running and Queued: no result.
• GET /api/v1/admin/work-items/events (text/event-stream, admin role only):
  • every 2 s (configurable) it re-queries for items whose UpdatedAt is newer than the last event and emits each changed item;
  • event ids let a reconnect with Last-Event-ID resume without gaps;
  • it works with a bearer token sent from fetch streaming.
• Items show only config ids and counts, never media. Admins still have no media access.
• The API reads work items only through a read-only reader or repository; it never touches AnichronDbContext (the existing api-reaches-data-through-repositories rule holds).
• Endpoint tests in the existing cheap endpoint-test style: filters and paging, 404, results by end state, and the SSE stream emitting changed items and resuming from Last-Event-ID, with time faked.
• 100% mutation score on the changed code.

First caller

The admin endpoints themselves, showing the TokenCleanup and WorkItemRetention items from the queue-core ticket. The Anichron.UI admin view is a later caller.

Design

Decided with the maintainer on 2026-10-18 (#276: SSE over WebSockets, a progress snapshot overwritten on each heartbeat, admin visibility without media).