feat: admin run-log diagnostics — extra viewer + metrics split

[BatLeDev]

Surface admin-only diagnostic detail in run logs, and stop polluting the user-facing error with resource metrics.

What changed

• UI (run-logs-list.vue): superadmins (adminMode) get a View extra toggle on any log entry carrying an extra payload, expanding a copyable code block; debug entries now render with the text-admin accent. Adds mdiChevronUp / mdiChevronDown / mdiContentCopy to the auto-imported icon set (vite.config.ts).
• Worker (exit-code.ts, runs.ts, worker.ts): diagnoseExit now returns the human-readable cause and the resource metrics (RSS/CPU/heap) as separate fields (adminMetrics / userMetrics). The worker writes metrics as an independent debug log entry (date offset +1ms so its key stays distinct) instead of appending them to the error message.
• Unit test updated to assert metrics land in adminMetrics / userMetrics.

Why
Expose per-entry extra and memory/CPU-at-failure to admins without mixing them into the user-facing error message.

Regression risks

• finish() gains a 4th optional param metricsMessage — existing callers are unaffected (defaulted), but failures now push two log entries (error + debug metrics) instead of one. Anything consuming run.log that assumed a single appended entry per failure should be checked.
• ExitDiagnosis gained two required fields (adminMetrics, userMetrics); all call sites updated here, but any other consumer of the type must set them.
• The extra viewer is gated on session.state.user?.adminMode (non-admins see no change) and uses navigator.clipboard (requires a secure context).