test, docs: admin page gate tests and the page's written rules (#102)

- web_test.go walks web.AdminPatterns() rather than naming routes by hand, so a
  new administrative route that forgets requireOwner fails the gate test
  instead of shipping open.
- The harnesses take a LaneReporter; a fake one keeps the page's tests free of
  a poller and a Site.
- backend/AGENTS.md records the adminRoutes/requireOwner rule and the nil-poller
  trap; design-system.md records --patina and the admin page's shape.

backend/cover_test.go

@@ -98,7 +98,7 @@ func TestPublicCoverNeverEchoesNonImage(t *testing.T) {
 	if _, err := db.Exec(`UPDATE covers SET content_type = 'text/html' WHERE address = $1`, address); err != nil {
 		t.Fatalf("poison row: %v", err)
 	}
-	rr := getCover(t, newRouter(st, testConfig()), "/covers/"+address, nil)
+	rr := getCover(t, newRouter(st, testConfig(), nil), "/covers/"+address, nil)
 	if rr.Code == http.StatusOK {
 		t.Fatalf("status = 200, want a refusal for a non-image row (body %q)", rr.Body.String())
 	}