feat: complete remaining Go backend modules

tests/admin-http-contract.test.ts

@@ -0,0 +1,17 @@
+import { readFile } from "node:fs/promises";
+import { describe, expect, it } from "vitest";
+
+describe("Go administration HTTP v1 contract", () => {
+  it("pins methods, authorization, and security projections", async () => {
+    const fixture = JSON.parse(await readFile(new URL("../contracts/admin/http-v1.json", import.meta.url), "utf8"));
+    const source = await readFile(new URL("../backend/internal/httpapi/admin.go", import.meta.url), "utf8");
+    expect(fixture.routes).toHaveLength(4);
+    expect(fixture.routes.filter((route: { path: string }) => route.path !== "/api/admin/accounts/groups").every((route: { requirement: string }) => route.requirement === "admin")).toBe(true);
+    expect(fixture.routes.find((route: { path: string }) => route.path === "/api/admin/accounts/groups")?.requirement).toBe("public-compatibility");
+    expect(source).toContain("PlatformAdmin");
+    expect(source).toContain("http.StatusGone");
+    const projection = source.slice(source.indexOf("func adminAccountProjection("));
+    for (const field of fixture.secretFields) expect(projection).not.toContain(`\"${field}\"`);
+    for (const field of fixture.accountProjection) expect(source).toContain(`\"${field}\"`);
+  });
+});