bug(implementer): production validation weakened to accommodate non-conformant test fixtures (Ed25519 size check bypassed)

**Severity:** HIGH
**Agent owners:** implementer

## Evidence

- S-6.06 `decodePublicKey` (cmd/switchboard/admin_handlers.go:111-130) accepted arbitrary opaque bytes (e.g., the literal string `"placeholder"` — 8 bytes after RawURL decode) as Ed25519 public keys.
- Doc comment claimed admission-layer size enforcement applies only at connection-auth time. But admin RPCs WRITE these bytes into the AdmittedKeySet before any connection auth happens.
- Adversary lens-2 F-002 + lens-1 F-005: enables fingerprint forgery, map-key squat/collision, persisted malformed keys.
- Root cause: e2e test fixtures used the literal "placeholder" pubkey; implementer relaxed validation to keep fixtures compiling rather than generating real 32-byte Ed25519 keys at test setup.

## Recommendation

implementer prompt rule: "production validation must enforce real-world invariants. If a test fixture is incompatible, FIX THE FIXTURE (generate a real key, etc.); do NOT weaken production validation."

Source: switchboard-blue Wave-5 S-6.06 Pass-1 lens-1 F-005 / lens-2 F-002