Add one-time administrator claims

[chubes4]

Summary

• issue deterministic 256-bit administrator capabilities for provisioned sites while persisting only capability and derived-credential digests
• expose the capability only in pending create/replay responses; site reads return fixed claim metadata without secrets
• atomically exchange the capability exactly once after publication completes for the persistent site-scoped admin credential
• pin the credential derivation before provisioning so password-root rotation cannot consume a claim with an invalid credential
• recover missing claims before scheduled provisioning, gate expired/pending states safely, and keep consumed claims from blocking later imports

Security contract

The claim endpoint is capability-authenticated and never accepts API bearer credentials. It transfers the persistent administrator credential; it does not claim to create a one-time browser session. Claim-root rotation preserves retained capabilities, while admin-root mismatch blocks provisioning/redemption until the matching root is restored.

Verification

• npm run test:cloudflare-runtime (25 provisioning/claim tests plus existing runtime suites)
• npm run test:cloudflare-wordpress-auth
• npm run cloudflare:dry-run
• npm run cloudflare:dry-run:d1
• git diff --check origin/main...HEAD

Fixes #1971

AI assistance

OpenAI gpt-5.6-sol was used through OpenCode to draft the implementation and tests and perform iterative adversarial reviews of capability leakage, concurrent consumption, lifecycle recovery, expiry, and secret rotation. Chris Huber reviewed the resulting behavior, verification evidence, and commit.