merge: integrate WP6-05 baseline for TASK-WP6-04

# Conflicts:
#	apps/api/src/app.ts
#	apps/api/src/main.ts
#	apps/web/src/generated/api/sdk.gen.ts
#	apps/web/src/generated/api/types.gen.ts
#	apps/web/src/main.tsx
#	openapi/openapi.json
#	package.json

apps/api/src/app.ts

@@ -22,6 +22,8 @@ import {
   ExternalServicePeriodTypeSchema,
   ExternalServiceStatusSchema,
   ExternalServiceUsageSchema,
+  AdminDiagnosticsResponseSchema,
+  AdminServicesStorageResponseSchema,
   AdminCreditParamsSchema,
   AdminLoginCompleteRequestSchema,
   AdminLoginCompleteResponseSchema,
@@ -127,6 +129,8 @@ import {
   type AdminLoginCompleteRequest,
   type AdminLoginSendRequest,
   type AdminOverviewResponse,
+  type AdminDiagnosticsResponse,
+  type AdminServicesStorageResponse,
   type AccountDeletionCompleteRequest,
   type AccountProfileUpdateRequest,
   type AdminCreditParams,
@@ -201,6 +205,7 @@ import { StickerReleaseError } from "./sticker-release-errors.js";
 import type { StickerReleaseService } from "./sticker-releases.js";
 import type { ManagedStorage } from "./managed-storage.js";
 import { PrivateContentError, PrivateContentService } from "./private-content.js";
+import { assertSafeAdminDiagnostics, assertSafeAdminServicesStorage } from "./admin-state.js";
 
 const defaultBootstrap: BootstrapResponse = {
   app_version: "0.0.0",
@@ -215,7 +220,9 @@ const defaultBootstrap: BootstrapResponse = {
 };
 
 export interface CreateAppOptions {
+  adminDiagnostics?: () => AdminDiagnosticsResponse | Promise<AdminDiagnosticsResponse>;
   adminOverview?: () => AdminOverviewResponse | Promise<AdminOverviewResponse>;
+  adminServicesStorage?: () => AdminServicesStorageResponse | Promise<AdminServicesStorageResponse>;
   amap?: AmapAdapter;
   assetReleases?: AssetReleaseReader;
   bootstrap?: () => BootstrapResponse | Promise<BootstrapResponse>;
@@ -758,6 +765,8 @@ export async function createApp(options: CreateAppOptions = {}) {
     ExternalServicePeriodTypeSchema,
     ExternalServiceStatusSchema,
     ExternalServiceUsageSchema,
+    AdminServicesStorageResponseSchema,
+    AdminDiagnosticsResponseSchema,
     CreditSummarySchema,
     CreditEntryTypeSchema,
     CreditEntryStatusSchema,
@@ -1769,6 +1778,33 @@ export async function createApp(options: CreateAppOptions = {}) {
     },
   );
 
+  app.get(
+    "/api/v1/admin/services-storage",
+    {
+      schema: {
+        operationId: "getAdminServicesStorage",
+        response: {
+          200: Type.Ref(AdminServicesStorageResponseSchema),
+          401: Type.Ref(ErrorEnvelopeSchema),
+          503: Type.Null(),
+        },
+        tags: ["Admin Operations"],
+      },
+    },
+    async (request, reply) => {
+      if (!options.registration) return reply.code(503).send(null);
+      const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
+      const session = token ? options.registration.readAdminSession(token) : undefined;
+      if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
+      if (!options.adminServicesStorage) return reply.code(503).send(null);
+      try {
+        return assertSafeAdminServicesStorage(await options.adminServicesStorage());
+      } catch {
+        return reply.code(503).send(null);
+      }
+    },
+  );
+
   app.patch(
     "/api/v1/admin/services/:service_id/limits",
     {
@@ -1849,6 +1885,33 @@ export async function createApp(options: CreateAppOptions = {}) {
     },
   );
 
+  app.get(
+    "/api/v1/admin/diagnostics",
+    {
+      schema: {
+        operationId: "getAdminDiagnostics",
+        response: {
+          200: Type.Ref(AdminDiagnosticsResponseSchema),
+          401: Type.Ref(ErrorEnvelopeSchema),
+          503: Type.Null(),
+        },
+        tags: ["Admin Operations"],
+      },
+    },
+    async (request, reply) => {
+      if (!options.registration) return reply.code(503).send(null);
+      const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
+      const session = token ? options.registration.readAdminSession(token) : undefined;
+      if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
+      if (!options.adminDiagnostics) return reply.code(503).send(null);
+      try {
+        return assertSafeAdminDiagnostics(await options.adminDiagnostics());
+      } catch {
+        return reply.code(503).send(null);
+      }
+    },
+  );
+
   app.post(
     "/api/v1/auth/login/send",
     {