feat(api): admin object create/update/delete (EditCatalogue, audited as user)

POST /api/admin/objects (draft|internal only; public rejected 422),
PUT /api/admin/objects/{id} (preserves visibility; 204/404),
DELETE /api/admin/objects/{id} (204/404). Every write records
AuditActor::User(<session-user-uuid>). Tests: lifecycle, public-rejection,
unauthenticated-rejection.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crates/api/src/openapi.rs

@@ -16,7 +16,10 @@ use crate::{AppState, admin, admin_objects, health, public};
         admin::list_users,
         admin::set_visibility,
         admin_objects::list_objects,
-        admin_objects::get_object
+        admin_objects::get_object,
+        admin_objects::create_object,
+        admin_objects::update_object,
+        admin_objects::delete_object
     ),
     components(schemas(
         health::Live,
@@ -28,7 +31,10 @@ use crate::{AppState, admin, admin_objects, health, public};
         admin::VisibilityRequest,
         admin_objects::AdminObjectView,
         admin_objects::AdminObjectPage,
-        admin_objects::LabelView
+        admin_objects::LabelView,
+        admin_objects::ObjectCreateRequest,
+        admin_objects::ObjectUpdateRequest,
+        admin_objects::CreatedObject
     )),
     info(title = "Collection Management System", version = "0.0.0")
 )]