Wire admin config into iBamboo runtime + next control plane tabs

[SteveSimonson]

Context

Admin POC is live at https://ibamboo.com/admin (#50 / #51). Config lives in ADMIN_KV but storefront still reads vibes.ts / hard-coded flags.

Runtime wiring

• Honor featureFlags.flashEnabled / conbalEnabled / quizCrmEnabled on client + worker
• Load avatars from admin config (fallback to vibes.ts)
• Expose Editor-in-Chief prompt to enrichment / agent jobs
• Optional public read endpoint for non-secret house voice (or inject at build/edge)

Recommended next controls (from POC debrief)

1. Catalog health — BSR last import, missing images, ASIN count by category
2. Enrichment queue — which PDPs have review snapshot / blog / FAQ; regenerate
3. Associates compliance — disclosure text, tag id display (read-only), no-tag chrome checklist
4. Quiz / CRM — GHL location status, last quiz submissions count
5. SEO kit — IndexNow trigger, sitemap counts, noindex audit for /admin
6. Audit log — who changed editor/avatars (KV append or CF logs)
7. Network hub later — multi-site switcher (Adazo, Mr Cuts, …) once pattern is proven

Hardening (review nits)

• Rate-limit login; constant-time password compare
• Allowlist fetch hosts for flash/library/conbal URLs
• Share AdminConfig types between worker + SPA