feat(admin): manage OpenMapX instances through the admin panel

.changeset/admin-instance-management-contracts.md

@@ -0,0 +1,11 @@
+---
+"@openmapx/extension-contracts": minor
+"@openmapx/extension-cli": patch
+---
+
+Export bounded service image-reference validation and reserve platform resource
+configuration names for trusted built-in services. Rebuild the extension CLI
+against the updated shared installation and service contracts.
+
+Keep newly created artifact and hardlink-consumer paths non-group-writable
+on hosts using umask `002`.

.dockerignore

@@ -62,3 +62,6 @@ yarn-error.log*
 *.pem
 **/*.pem
 docs/
+
+# Role-private control signing and recovery material
+infra/docker/control-private/

.gitignore

@@ -148,3 +148,6 @@ dist/mobile/
 
 # Generated Traefik file-provider routing (produced by `openmapx compose render`).
 services/traefik/config/dynamic/generated-routes.yml
+
+# Role-private control signing and recovery material
+infra/docker/control-private/