🌱 [scanner] introduce handlers.Deps and Registrar; port admin subpackage

[hivecommons-hive]

Refs #23725 (partial: slice 2a + admin template per the issue's plan; remaining 2b ports of k8s/proxy/ops/dashboards/persistence and 2c route-group collapse are follow-up PRs)

What changed

Slice 2a — handlers.Deps + handlers.Registrar (new pkg/api/handlers/registrar.go)

• Deps carries the shared dependency set with the repo's real types: store.Store, *transport.Hub, *k8s.MultiClusterClient, *store.PersistenceStore, *notifications.Service, *middleware.FailureTracker, GitHubToken string.
• The issue sketch had a Config *config.Config field; Config lives in package api, which imports handlers, so config-derived values are carried as explicit fields (GitHubToken today) to avoid an import cycle. This is documented in the file.
• Registrar is Register(router fiber.Router, deps Deps). No behavior change; every existing constructor still works.

Slice 2b — admin/ ported as the template (new pkg/api/handlers/admin/registrar.go)

• admin.NewRegistrar() handlers.Registrar builds SettingsHandler, TeamHandler, RBACHandler and AdminHandler from Deps and registers the exact same paths/methods/order previously hand-wired in route_group_api_core.go (settings) and route_group_governance.go (teams, RBAC, /admin/rate-limit-status).
• Call sites replaced with a single admin.NewRegistrar().Register(api, handlers.Deps{...}) in the api-core route group (it runs first and now receives failureTracker); the governance group drops those blocks and its now-unused failureTracker dependency.
• /api/me stays in the route group because it is mounted on the app with bodyGuard/csrfGuard/jwtAuth — auth middleware deliberately stays in the route group per the issue. It now imports admin.NewUserHandler directly.
• pkg/api/handlers/admin_aliases.go deleted: go build ./... confirms nothing else referenced the root re-exports (the only 5 call sites were the two route groups). Deleting it also removes the handlers -> admin edge, so admin can import handlers for Deps/Registrar without a cycle.

No route paths, methods, middleware or handler semantics changed — this is a pure wiring refactor.

Verification

• go build ./... — clean.
• go vet ./pkg/api/... — clean.
• go test ./pkg/api/... — all packages pass, including routes_registration_test.go (full-server route table: asserts /api/settings is registered exactly once, plus all /api/teams*, /api/users*, /api/rbac/*, /api/admin/rate-limit-status routes) and route_group_api_core_test.go.
• New pkg/api/handlers/admin/registrar_test.go locks the 24-route surface the registrar owns so later ports can't silently drop a route.
• No frontend tooling touched — backend-only change.

— hive: agent=scanner backend=copilot model=claude-fable-5 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for kubestellarconsole canceled.

Name	Link
🔨 Latest commit	c85eb16
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/6ab6a84f4ef1240008e8abaf

[github-actions]

👋 Hey @hivecommons-hive[bot] — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

• Claude Code (Opus 4.5 / 4.6) — recommended
• GitHub Copilot
• Cursor
• Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

---

This is an automated message.

[github-actions]

Thank you for your contribution! Your PR has been merged.

Check out what's new:

• KubeStellar Console — Live multi-cluster dashboard
• Marketplace — Community extensions
• Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

[github-actions]

Post-merge build verification passed ✅

Both Go and frontend builds compiled successfully against merge commit 4ae4df98e35f0b1c57cefbb6cc7e07ac7e4464e8.

[github-actions]

✅ Post-Merge Verification: passed

Commit: 4ae4df98e35f0b1c57cefbb6cc7e07ac7e4464e8
Specs run: smoke.spec.ts
Report: https://github.com/kubestellar/console/actions/runs/36167279141

[hivecommons-hive]

Read the diff against the tree at merge-base 47b5c855 and verified this is the pure wiring refactor the body claims.

Route parity verified. The admin registrar (pkg/api/handlers/admin/registrar.go) registers the same 24 paths/methods, in the same order, as the blocks removed from route_group_api_core.go (settings, was lines ~142–146) and route_group_governance.go (teams/RBAC/rate-limit, was lines ~26–68). Constructor args are unchanged: NewRBACHandler(deps.Store, deps.K8sClient), NewAdminHandler(deps.FailureTracker, deps.Store) — and FailureTracker is still sourced from s.auth.failureTracker (routes_api_core.go:13), the same value governance previously passed.

Middleware parity verified. The registrar mounts on the same routes.api group (route_group_api_core.go:52) that the governance group used, created at routes_auth.go:292 with apiLimiterWithSkip, bodyGuard, csrfGuard, jwtAuth — no auth surface changed.

Alias deletion is safe. Grepped the PR head: no remaining references to the deleted admin_aliases.go re-exports outside pkg/api/handlers/admin; the one non-registrar call site (/api/me) now imports admin.NewUserHandler directly.

Ran locally at head c85eb16: go build ./pkg/... clean; go test ./pkg/api/ ./pkg/api/handlers/... all pass, including the new registrar route-surface lock test and the full-server routes_registration_test.go.

Looks correct to me. Refs #23725 (partial) is appropriate — slices 2b (remaining subpackages) and 2c (route-group collapse) are explicitly deferred.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88