feat(sp36): absorb 20 admin endpoints into api_routers/admin.py

Moves the entire /api/admin/* namespace (audit-log ×2, db/rotate-key ×1,
backup ×10, scheduler ×6, reload-config ×1) out of api.py and into the
existing api_routers/admin.py, which already owned /api/admin/validate-provider.

- api.py: 4294 → 3547 LOC (Δ -747). Removed the orphaned # --- separator
  left behind by the cut, the orphaned 'return {ok,loaded,errors}'
  tail of reload-config, and the now-unused cyclone.clearhouse.InboundFile
  top-level import.
- api_routers/admin.py: 60 → 851 LOC. Added the imports the moved
  routes need (json, logging, threading, time, AuditEvent, verify_chain,
  InboundFile) and stripped the redundant top-level imports of
  symbols that the route bodies reach via the inline _db_crypto /
  _secrets / _backup_svc_mod / _backup_sched_mod / _scheduler_mod
  / _audit aliases (those aliases stay — tests rely on being able to
  monkeypatch cyclone.api_routers.admin._X.method). Hoisted the inline
  'import time' from inside pull_inbound to module scope. Dropped
  the redundant 'import threading as _threading' alias — top-level
  'import threading' already covers it.
- tests/test_api_rotate_key.py: 4 monkeypatch targets migrated from
  cyclone.api._db_crypto / cyclone.api._secrets to
  cyclone.api_routers.admin._db_crypto / cyclone.api_routers.admin._secrets
  to match the new home of the rotate-key endpoint. Lock acquire/release
  also migrated.

The non-admin /api/config/* and /api/payers/{id}/summary routes that
bracketed the moved admin blocks stay in api.py — they're extracted
in Tasks 5 & 6.

Behaviour-preserving: pytest = 20 failed / 1253 passed / 10 skipped
= baseline match. Admin-only subset (audit-log + backup + scheduler +
rotate-key + reload-config) = 34 passed.

backend/tests/test_api_rotate_key.py

@@ -82,7 +82,9 @@ class TestRotateKeyEndpointWiring:
                             lambda n, v: fake_kc.__setitem__(n, v) or True)
         # The endpoint's actual rekey is stubbed; the real PRAGMA
         # rekey mechanics are tested in test_db_crypto.py::TestRotateDbKey.
-        monkeypatch.setattr("cyclone.api._db_crypto.rotate_db_key", _stub_rotate_ok)
+        # SP36 Task 3: this endpoint moved from cyclone.api to
+        # cyclone.api_routers.admin; patch the live import surface.
+        monkeypatch.setattr("cyclone.api_routers.admin._db_crypto.rotate_db_key", _stub_rotate_ok)
         db.init_db()
         yield db_file, fake_kc
         db._reset_for_tests()
@@ -151,7 +153,7 @@ class TestRotateKeyEndpointWiring:
                 rotated_at=datetime.now(timezone.utc).isoformat(),
                 reason="simulated PRAGMA rekey failure",
             )
-        monkeypatch.setattr("cyclone.api._db_crypto.rotate_db_key", _fail_rotate)
+        monkeypatch.setattr("cyclone.api_routers.admin._db_crypto.rotate_db_key", _fail_rotate)
 
         _, fake_kc = _fake_encrypted_env
         before = dict(fake_kc)
@@ -187,7 +189,8 @@ class TestRotateKeyEndpointWiring:
         restore-key command."""
         from cyclone import db
         # Override the set_secret at the import-site of the endpoint.
-        monkeypatch.setattr("cyclone.api._secrets.set_secret", lambda n, v: False)
+        # SP36 Task 3: endpoint moved to cyclone.api_routers.admin.
+        monkeypatch.setattr("cyclone.api_routers.admin._secrets.set_secret", lambda n, v: False)
 
         from fastapi.testclient import TestClient
         from cyclone.api import app
@@ -202,10 +205,11 @@ class TestRotateKeyEndpointWiring:
         """A second concurrent rotation request gets 409 — only one
         rotation can run at a time (the module-level lock)."""
         monkeypatch.setattr(
-            "cyclone.api._secrets.set_secret", lambda n, v: True,
+            "cyclone.api_routers.admin._secrets.set_secret", lambda n, v: True,
         )
-        from cyclone import api as api_mod
-        api_mod._db_rotate_lock.acquire()
+        # SP36 Task 3: lock moved with the endpoint into admin router.
+        from cyclone.api_routers import admin as admin_mod
+        admin_mod._db_rotate_lock.acquire()
         try:
             from fastapi.testclient import TestClient
             from cyclone.api import app
@@ -214,4 +218,4 @@ class TestRotateKeyEndpointWiring:
             assert r.status_code == 409
             assert "in progress" in r.json()["detail"]
         finally:
-            api_mod._db_rotate_lock.release()
+            admin_mod._db_rotate_lock.release()