feat: Add Blob Storage Explorer to Staff Portal Tech Admin

[Copilot]

Adds a read-only Blob Storage Explorer to the Staff Portal Tech Admin area, gated by staffRole.techAdminPermissions.canViewBlobExplorer. Follows the existing Database Explorer / Queue Explorer patterns.

Backend

@cellix/service-blob-storage

• New listContainers(): Promise<ContainerListItem[]> on BlobStorage interface
• New listBlobsDetailed(request: ListBlobsDetailedRequest): Promise<BlobDetailedListResult> with server-side pagination (continuation tokens), metadata, tags, and optional name/tag filtering via findBlobsByTags
• New types: ContainerListItem, BlobDetailedItem, BlobDetailedListResult, ListBlobsDetailedRequest

@ocom/service-blob-storage

• Extended BlobStorageOperations Pick to include listContainers and listBlobsDetailed
• Extended ClientUploadOperations to include generateReadSasToken
• Re-exports new types from the ocom barrel

@ocom/application-services

• New TechAdmin.BlobExplorer context with listContainers(), listBlobs(), generateBlobSasUrl() (SAS token valid for 5 min)

@ocom/graphql

extend type Query {
  blobContainers: [BlobContainer!]!
  blobExplorerList(input: BlobExplorerListInput!): BlobExplorerListResult!
  blobExplorerSasUrl(containerName: String!, blobName: String!): String!
}

All three queries enforce canViewBlobExplorer || canManageTechAdmin via a shared auth helper. Resolver unit tests included.

Frontend (@ocom/ui-staff-route-tech-admin)

• BlobExplorerPage – top-level page; redirects to /unauthorized if permission absent
• BlobContainerSelectorContainer – lists containers, drives selectedContainer state
• BlobListContainer – paginated blob listing with virtual folder navigation and breadcrumbs
• BlobDetailContainer – modal with preview (image, PDF, text, JSON) and download via SAS URL
• BlobFilter – name filter + tag filter expression inputs
• Tech Admin navigation (section-layout.tsx) gains the "Blob Storage Explorer" entry, visible only when canViewBlobExplorer is true
• use-staff-permissions.ts updated to surface canViewBlobExplorer from the GraphQL permissions query
• codegen.yml updated with tech-admin codegen target

• Fixes Add Blob Storage Explorer page to Staff Portal Tech Admin to navigate and verify blobs in storage account #303