refactor(web): 拆 lib/api.ts 789→109 barrel + lib/api/ 8域文件(纯搬移零逻辑)

- lib/api/{core,auth,chat,sessions,personas,admin,adminChannels,adminSystem}.ts
- api.ts 改纯 barrel 显式 re-export(export type for types, isolatedModules); 导出名 77→77, 36处导入点零改动
- 代码行多重集比对一致(仅 request/limitQuery 各加一 export 供兄弟模块); 每文件≤500/函数≤80
- 前端 build 绿(165 modules)

frontend/web/src/lib/api/adminSystem.ts

@@ -0,0 +1,79 @@
+import type {
+  AdminNotification,
+  AdminNotificationQuery,
+  AdminObservabilityMetrics,
+  AdminTraceSpan,
+  AuditRecord,
+  BackthinkItem,
+  SystemBackupResp,
+  SystemRestoreResp,
+  SystemRevokeKeysResp,
+  SystemRotateJwtResp,
+} from "../types";
+import { limitQuery, request } from "./core";
+
+/** GET /api/v1/admin/observability/metrics — gateway request metrics. */
+export function adminObservabilityMetrics(): Promise<AdminObservabilityMetrics> {
+  return request<AdminObservabilityMetrics>("/admin/observability/metrics");
+}
+/** GET /api/v1/admin/observability/trace?limit=N — most recent traced spans. */
+export function adminObservabilityTrace(limit?: number): Promise<AdminTraceSpan[]> {
+  return request<AdminTraceSpan[]>(`/admin/observability/trace${limitQuery(limit)}`);
+}
+/** GET /api/v1/admin/observability/audit?limit=N — most recent audit entries. */
+export function adminObservabilityAudit(limit?: number): Promise<AuditRecord[]> {
+  return request<AuditRecord[]>(`/admin/observability/audit${limitQuery(limit)}`);
+}
+
+/** GET /api/v1/admin/backthink — persisted background-think records (newest first). */
+export function adminBackthink(limit?: number): Promise<BackthinkItem[]> {
+  return request<BackthinkItem[]>(`/admin/backthink${limitQuery(limit)}`);
+}
+
+/** GET /api/v1/admin/notifications?type=&before=&limit= — the unified notification
+ *  feed (design/10 §3 #16: audit + channel + backthink + system aggregated).
+ *  `type` omitted = all types, `before` = createdAt(ms) cursor for older pages,
+ *  `limit` defaults to 50 (backend caps at 200). Returned newest first. */
+export function adminListNotifications(
+  params: AdminNotificationQuery = {}
+): Promise<AdminNotification[]> {
+  const qs = new URLSearchParams();
+  if (params.type) qs.set("type", params.type);
+  if (params.before !== undefined) qs.set("before", String(params.before));
+  if (params.limit !== undefined) qs.set("limit", String(params.limit));
+  const q = qs.toString();
+  return request<AdminNotification[]>(`/admin/notifications${q ? `?${q}` : ""}`);
+}
+
+/* ----------------------------------------------------------------------------
+ * System management admin writes (owner-only, audited). Reference:
+ * internal/services/gateway/admin_system.go + Docs/api-client.md §系统设置契约.
+ * All four are implemented (not 501) — they return real data.
+ * -------------------------------------------------------------------------- */
+
+/** POST /api/v1/admin/system/revoke-keys — revokes every registered API key. */
+export function adminSystemRevokeKeys(): Promise<SystemRevokeKeysResp> {
+  return request<SystemRevokeKeysResp>("/admin/system/revoke-keys", { method: "POST" });
+}
+/** POST /api/v1/admin/system/rotate-jwt — swaps the JWT signing secret (≥32 chars).
+ *  The secret is provided by the owner and never echoed back; all existing tokens
+ *  become invalid, so the client must re-login afterward. */
+export function adminSystemRotateJWT(newSecret: string): Promise<SystemRotateJwtResp> {
+  return request<SystemRotateJwtResp>("/admin/system/rotate-jwt", {
+    method: "POST",
+    body: JSON.stringify({ newSecret }),
+  });
+}
+/** POST /api/v1/admin/system/backup — snapshots the SQLite DB (VACUUM INTO, incl. WAL). */
+export function adminSystemBackup(): Promise<SystemBackupResp> {
+  return request<SystemBackupResp>("/admin/system/backup", { method: "POST" });
+}
+/** POST /api/v1/admin/system/restore — restores a data-dir backup; path must live
+ *  inside the data directory (path-traversal guard). The backend pre-backups the
+ *  current DB and reports that the swap needs a restart. */
+export function adminSystemRestore(path: string): Promise<SystemRestoreResp> {
+  return request<SystemRestoreResp>("/admin/system/restore", {
+    method: "POST",
+    body: JSON.stringify({ path }),
+  });
+}