admin: explicit, audited override on repositories for moderation #71

internal/policy/access.go has no IsAdmin clause, so an instance admin cannot archive, hide, or delete a spam repository, and no host-local command does it either.

Keep reads as they are so private repos still 404 to admins. For moderation add explicit commands that audit every use:

• admin repo list [--owner] [--visibility] with size and last push (ListAllRepos already exists for gc and stats)
• admin repo archive <owner/name>
• admin repo visibility <owner/name> public|private
• admin repo delete <owner/name> --yes

Do not make IsAdmin imply CanAdmin everywhere; the override should be visible in the audit log.