feat: add an admin instruments page, and let administrators archive series

[thomasbeaudry]

A series that has been administered can never be deleted, so there was no way to retire one. This adds an Instruments submenu to the Admin Panel with two views of /admin/instruments:

• Form & Interactive — every instrument at its current edition, with kind, source, the groups using it and the date added. Preview from the row menu or by double-clicking a row.
• Series — every series with its owning group (or "All groups"), and Preview / Archive / Unarchive from the row menu. Double-click archives (through a confirmation) or unarchives.

What archiving does: an archived series is hidden from the start-session, remote-assignment (single and bulk) and group-manage pickers, and the API refuses new assignments of it. Collected records and outstanding assignments are untouched, and it stays on each group's selection so unarchiving restores it. Archive and unarchive are new audit-log actions, tagged with the owning group.

API

• GET /v1/instruments/series and PATCH /v1/instruments/series/:id ({ isArchived }), both ADMIN_ONLY; added to the route inventory in auth-and-permissions.md.
• Instrument.archivedAt, exposed on series info; ARCHIVE / UNARCHIVE audit actions.
• An administrator's bundle lookups are no longer narrowed to their own groups (they belong to none), so they can preview a group-owned series. accessibleQuery still applies.
• The archived-series check in AssignmentsService is deliberately unscoped: it only narrows ids the caller already named.

Web: the group-manage preview dialog moved to src/components/InstrumentPreviewDialog and is shared; the pickers share one selectAdministrableInstruments rule.

Verification

• Unit: instruments.service.spec.ts, instruments.controller.spec.ts, assignments.service.spec.ts (API); administrable-instruments.test.ts, series-overview.test.ts, instrument-editions.test.ts, useSeriesInstrumentsOverviewQuery.test.ts (web). pnpm lint and pnpm test pass.
• E2E: testing/src/specs/admin-instruments.spec.ts.

Not run locally:

• The Playwright suite: the local dev stack held its ports, so the e2e spec is left to CI.
• The page was not checked in a browser as an administrator.

route-tree.ts was regenerated by the running dev server, not by hand.

Follow-up, out of scope here: #1587 (deleting a group turns its series into shared ones).

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com