feat(install): /install configurator + /admin/diagnostics routes

Backend half of the in-app install/configuration UI.

  * lib/install/manifest.ts        - declarative manifest of every
                                     config item the app expects (KV
                                     secret names, env-only items,
                                     readiness checks).  Functional
                                     documentation: anyone with this
                                     code can rebuild the configurator,
                                     no proprietary IP.

  * lib/install/installAuth.ts     - bootstrap-token + Entra OIDC auth
                                     for /install.  The bootstrap token
                                     burns on first successful Entra-
                                     admin sign-in.

  * lib/install/sessionTokens.ts   - short-lived HMAC-signed cookies
                                     keyed off the bootstrap or OIDC
                                     identity.

  * lib/install/types.ts           - manifest model types.

  * lib/install/checks/*           - manifest readiness probes for
                                     installer access and Entra
                                     redirect-uri registration.

  * routes/install.ts              - server-rendered HTML configurator
                                     UI.  Reads/writes Key Vault via
                                     getConfig/setConfig.  GET /install/
                                     scripts/:name returns 404 when
                                     scripts/install/ is absent - that
                                     directory ships with the separate
                                     deploy package, not the application
                                     image, so the application-only
                                     deployment degrades cleanly.

  * routes/diagnostics.ts          - /admin/diagnostics health page.
                                     Operator-grade utility that runs
                                     every manifest probe and reports
                                     status; useful in any deployment.

Adds cookie-parser + @types/cookie-parser to support the configurator's
short-lived session cookies.  The routers themselves are not yet
mounted on the Express app - that wiring lands in the bundled-frontend
commit so this one stays focused on the configurator surface.