Phase 3+4: 共享 HTTP 客户端 + admin API + audit log

Phase 3 (httpclient):
- shared Client (Timeout + MaxResponseBytes 截断)
- SSRF: 16 段私网 CIDR (含 169.254/::ffff:0:0/96 IPv4-mapped)
  + hostname allowlist (精确/后缀/*. 通配)
  + scheme 校验 (仅 http/https)
- auth 适配器: none / simple (YARN user.name) / basic (SetBasicAuth)
- DoWithRedirect: 跨主机跳转保留 Authorization, max 5 默认
- 19 个测试全绿 (httptest 模拟)

Phase 4 (admin + audit):
- internal/audit: Entry + Repo.Insert/List + MarshalDetails, snake_case JSON
- internal/middleware: AdminAuth/AgentAuth (constant-time 比对)
- internal/admin: 6 端点 (GET/POST/PUT/DELETE /admin/clusters, GET /admin/audit)
  + 写操作触发 audit_log (含 before/after diff)
  + AuthPassword 空=保留旧密码
  + 校验: 必填字段 + auth_type 枚举 + rate_limit>=0
- main.go: 挂载 storage.Open + admin.Mount
- L fix: audit.Entry 加 json tag (smoke test 发现大写 key 不规范)

Co-Authored-By: Claude <noreply@anthropic.com>

main.go

@@ -1,7 +1,7 @@
 // Command spark-mcp-go launches the Spark MCP Server.
 //
-// Phase 0 scope: wire config + slog + Gin + /healthz.
-// Full MCP transport, admin API, and Tool surface land in later phases.
+// Phase 4 scope: wire config + slog + Gin + /healthz + /admin/* cluster CRUD
+// with audit log. MCP transport and Tool surface land in later phases.
 package main
 
 import (
@@ -16,8 +16,11 @@ import (
 
 	"github.com/gin-gonic/gin"
 
+	"spark-mcp-go/internal/admin"
+	"spark-mcp-go/internal/audit"
 	"spark-mcp-go/internal/config"
 	"spark-mcp-go/internal/logging"
+	"spark-mcp-go/internal/storage"
 )
 
 func main() {
@@ -50,6 +53,13 @@ func run() error {
 		return err
 	}
 
+	db, err := storage.Open(cfg.SQLitePath)
+	if err != nil {
+		return err
+	}
+	defer db.Close()
+	logger.Info("storage.open", "path", cfg.SQLitePath)
+
 	gin.SetMode(gin.ReleaseMode)
 	r := gin.New()
 	r.Use(gin.Recovery())
@@ -58,6 +68,8 @@ func run() error {
 		c.JSON(http.StatusOK, gin.H{"ok": true, "version": "0.0.0"})
 	})
 
+	admin.Mount(r, db.Clusters(), audit.NewRepo(db), cfg.AdminTokens)
+
 	srv := &http.Server{
 		Addr:              cfg.ListenAddr,
 		Handler:           r,