feat(admin-dashboard): keeper health and vault state panels

[Mamavee001]

closes #615

Note on the #614 dependency

This issue's acceptance criteria depend on #614 ("Admin dashboard: auth gate"), which is still open and assigned to someone else. Rather than block on it, this PR adds a minimal, explicitly-placeholder admin route shell (/app/admin, gated client-side by useIsAdminWallet against a VITE_ADMIN_ADDRESSES allow-list) so the two panels have somewhere to live. useIsAdminWallet is documented as a placeholder in its own comment and in AdminDashboard.tsx — #614 should replace it wholesale, not extend it. Nothing sensitive is actually gated by it: both new read endpoints are public, on-chain data, the same way /api/v1/vaults already is.

Summary

• Keeper Health card: one row per keeper (accrual, migration) with a status dot, last successful run, and either the schedule interval or how overdue it is.
• Vault State card: current adapter (resolved to a protocol label via the existing PROTOCOL_LABEL mapping, now shared out of VaultPanel.tsx), total shares, total assets, and an Active/Paused badge.
• Both match VaultPanel.tsx's existing loading-skeleton and error/retry patterns.

Changes

SDK (packages/stellar-sdk-helpers)

• New keeper-heartbeat.ts: records/reads each keeper's last successful run. This is a genuinely new data source — keeper-state.ts's submission leases deliberately clear their record on success (they exist to dedup in-flight submissions, not to remember history), so "last successful run" wasn't recorded anywhere before. Backed by the same Upstash Redis REST API keeper-state.ts already uses, with an in-memory fallback for local dev.
• coordinator.ts: new fetchCoordinatorState reads the vault's active adapter/protocol, total shares, total assets, and is_paused().

API

• api/v1/keepers/accrue.ts / rebalance.ts: record a heartbeat on a clean (zero-failure) run only, best-effort, after the response status is already decided — a heartbeat-store hiccup never turns a successful run into a reported failure, and a failed run never reports healthy.
• New public, read-only endpoints: GET /api/v1/keepers/health and GET /api/v1/admin/vault-state, implemented in packages/api-core/src/admin.ts and mirrored into the local Fastify server (apps/api-local) for dev parity.

Frontend (apps/web)

• KeeperHealthPanel.tsx, VaultStatePanel.tsx, their hooks (useKeeperHealth, useVaultState), and AdminDashboard.tsx (the page).
• App.tsx picks between the main dashboard and /app/admin via a plain pathname check — no router dependency for one extra static route.
• PROTOCOL_LABEL moved out of VaultPanel.tsx into lib/protocolLabels.ts so both panels share it without duplication.
• i18n strings added to en.json/fr.json.

Docs: apps/docs/architecture/api.md (new endpoints), apps/docs/architecture/frontend.md (component structure), apps/docs/operations/environment-variables.md and .env.example (VITE_ADMIN_ADDRESSES, documented as a placeholder).

Test plan

• packages/stellar-sdk-helpers: 296 tests pass (17 new, covering keeper-heartbeat.ts and fetchCoordinatorState).
• packages/api-core: 28 tests pass (10 new, covering handleGetKeeperHealth/handleGetVaultState).
• api (Vercel handlers): 50 tests pass (7 new/updated — heartbeat recorded on success and not on failure, plus the two new endpoints).
• apps/api-local: 24 tests pass (pre-existing, unaffected).
• apps/web: 101 tests pass (12 new, covering both panels and the dashboard's connect/unauthorized/authorized states).
• cargo test unaffected (no contract changes in this PR).
• Manually verified in a live dev server: /app/ and /app/admin both render correctly (disconnected states); eslint and tsc clean across every touched package.

Caveats

• The auth gate is a placeholder — see the note above. [Feature] Admin dashboard: auth gate #614 should replace useIsAdminWallet with real server-enforced auth.
• Couldn't click through the fully-connected "admin" visual state in the sandboxed preview browser (no Freighter extension available there); that path is covered by the component test suite instead (AdminDashboard.test.tsx).

[vercel]

@Mamavee001 is attempting to deploy a commit to the Collins' projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Mamavee001 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits