feat(api): admin vocabulary + term management

GET/POST /api/admin/vocabularies and GET/POST /api/admin/vocabularies/{id}/terms;
reads gated on ViewInternal, writes on EditCatalogue; labels round-trip verified.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crates/db/src/vocab.rs

@@ -26,6 +26,18 @@ where
     })
 }
 
+/// List all vocabularies, ordered by key.
+pub async fn list_vocabularies<'e, E>(executor: E) -> Result<Vec<Vocabulary>, sqlx::Error>
+where
+    E: sqlx::PgExecutor<'e>,
+{
+    let rows = sqlx::query("SELECT id, key FROM vocabulary ORDER BY key")
+        .fetch_all(executor)
+        .await?;
+
+    rows.into_iter().map(map_vocabulary).collect()
+}
+
 /// Look up a vocabulary by its key.
 pub async fn vocabulary_by_key<'e, E>(
     executor: E,