cmc Closes #32. Admin-only mirrors section in repo show (direction, URL, pending, last sync, last error) and an admin-only mirror status line in the web repo header, with a sync-error state. Tokens never leave the server.