feat(admin): deep-linkable console URLs, stop collapsing unknown paths to /admin

The root catch-all page ([...slug].vue) redirected every unknown URL to
/admin, and the worker fell back to the SPA for any path — so no matter
what page was opened, the URL ended up at baseurl/admin.

- Extract the console into ConsolePage.vue; the active tab now mirrors
  the URL path: /admin (groups), /admin/groups, /admin/logs, /admin/audit
  (tab switches use router.replace; unknown slugs render 404)
- admin.vue and admin/[slug].vue become thin wrappers
- Delete the root [...slug].vue catch-all redirect
- server.ts: notFound serves ASSETS (SPA + _nuxt chunks) only for
  /admin-prefixed paths; every other unknown URL returns a JSON 404

src/server.ts

@@ -79,7 +79,18 @@ export function createServer(): Hono<{ Bindings: Env }> {
 
   app.notFound((c) => {
     if (c.env.ASSETS) {
-      return c.env.ASSETS.fetch(c.req.raw);
+      // The console SPA (and its _nuxt chunks) lives under /admin; the worker
+      // already owns /admin/api, /admin/login|logout|invite. Serve the SPA
+      // only for admin-scoped paths — every other unknown URL is a plain 404
+      // instead of being swallowed into the console.
+      const pathname = new URL(c.req.url).pathname;
+      if (
+        pathname === "/admin" ||
+        pathname.startsWith("/admin/") ||
+        pathname.startsWith("/_nuxt/")
+      ) {
+        return c.env.ASSETS.fetch(c.req.raw);
+      }
     }
     return c.json({ error: "Not found" }, 404);
   });