epic: the wire contract stops at enqueue and read

Why

The producer door does enqueue, batch, read, cancel, count and workflow submission. That is the
whole network contract. Everything else FlexiQ can do — pause a queue, replay a dead letter,
drain a worker, change a rate limit, edit a periodic task — is reachable only from the dashboard
or from a process with the core compiled into it.

So automation is worse off than a human. An operator can drain a worker by clicking; a script
cannot, unless the script is written in one of three languages and given a database connection.
That inverts the usual order and it is the largest functional hole in the server story.

Four smaller holes sit beside it. A remote client that wants a result has to poll
GET /v1/jobs/{id}, because job.result() has no wire equivalent. The listener does not
terminate TLS at all — crates/flexiq-server/README.md says so plainly and points at a sidecar.
Token scopes are two bits, produce and execute, so "read-only", "this queue only" and "this
task only" cannot be expressed. And nothing records which token enqueued what.

Shape

• flexiq.admin.v1 — a third service beside flexiq.v1 and flexiq.executor.v1, carrying
  the operations the dashboard already performs.
• WatchJobs — a server stream, so awaiting a result is not a poll loop.
• TLS and mTLS in-process, for the deployments that are not behind a mesh.
• Finer scopes — read-only, per-queue, per-task, on top of the namespace binding that
  already exists.
• An audit trail of token-attributed writes.
• Per-namespace quotas — namespaces exist as a tenancy boundary with no limits attached.

What this is not

Not a proxy over Storage. #710 rejected that and the reasoning still holds: the trait is
~110 methods with a three-backend parity obligation each, and mirroring it into RPCs inherits
the whole internal admin surface including the settings KV. The admin service exposes the
operations an operator performs, named as operations, not the rows behind them.

Not a second authorization model. Scopes get finer; the namespace binding at mint time
stays exactly as it is. A token minted for one namespace is refused by a listener serving
another, and nothing here weakens that.

Start with crates/flexiq-server/README.md and trace the existing flexiq.v1 and flexiq.executor.v1 services, the dashboard operations, and GET /v1/jobs/{id}. Define the scope and implementation boundaries for flexiq.admin.v1, WatchJobs, TLS/mTLS, finer token scopes, audit attribution, and namespace quotas; done requires an agreed plan or coordinated implementation across these areas.