Admin panel (warp-admin) and the apps/ui design system

apps/ui: Warp's design system for Vue 3 + Tailwind v4. Tokens, fonts,
icons and logo come from the brand package, with a Tailwind theme on the
tokens and Vue components on the brand component styles.

apps/admin: the admin panel as a separate, optional service. warp-admin
embeds the built Vue app and proxies only the login endpoints and
/_warp/admin/v1 to the homeserver. Pages: dashboard, users, rooms,
federation, registration and tokens, server notices, application
services, audit log.

Also: pnpm workspace, go.work entry, Dockerfile, an `admin` compose
profile, Makefile targets, a CI job with a proxy smoke test, and docs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose/docker-compose.yml

@@ -8,7 +8,8 @@
 # reverse proxy in front of it before pointing a domain at it; see
 # docs/deployment.md. With the observability profile, Grafana is on
 # http://localhost:3000 (admin / admin, change it), Prometheus on :9090 and
-# the Jaeger UI on :16686.
+# the Jaeger UI on :16686. With the admin profile, the admin panel is on
+# http://localhost:8009.
 #
 # Create the first administrator once the server is up:
 #
@@ -63,6 +64,24 @@ services:
     ports:
       - "8008:8008"
 
+  # The admin panel is optional. Start it with the admin profile:
+  #   docker compose --profile admin up -d
+  # It is on http://localhost:8009 and reaches the homeserver over the
+  # compose network, so /_warp/admin never has to be public.
+  admin:
+    build:
+      context: ../..
+      dockerfile: apps/admin/Dockerfile
+    image: warp-admin:latest
+    profiles: [admin]
+    restart: unless-stopped
+    depends_on:
+      - warp
+    environment:
+      WARP_ADMIN_HOMESERVER: http://warp:8008
+    ports:
+      - "${WARP_ADMIN_PORT:-8009}:8009"
+
   prometheus:
     image: prom/prometheus:v3.5.0
     profiles: [observability]