feat(#2): BifrostState pane — GET /admin/sessions/{id}/bifrost (admin-key)

v1 coverage-audit: the last unbuilt design-brief §5 debug widget. First
admin-key consumer in ratatoskr.

- sessions.py: get_session_bifrost(client, session_id, *, admin_key) —
  admin-scoped (admin.sessions.read); the request overrides Authorization
  with admin_key (distinct from the consumer bearer). 200 -> dict, non-200
  -> SessionApiFailed (403 scope-denied, 404 not-bound).
- cli.py: --admin-key flag + RATATOSKR_ADMIN_API_KEY env -> ParsedArgs.admin_key.
- tui.py: new "Bifrost" TabPane + _format_bifrost_state + _hydrate_bifrost_state
  best-effort worker (unconditional on_mount). Writes {endpoint, connected,
  caps, tools} + audits; self-labels "not configured" / "not bound" / graceful
  on 403+error, never crashes.
- Contract #2 amended (FN, incl. the bearer-override POST) + validated. TDD:
  4 wrapper tests + 1 format unit + 3 hydrate integration. Suite 552 green.
- LIVE-AUTH-PROVEN on :8081 (admin key reached resource-layer 404, not 401/403).

Ledger correction: #11 (AdminEvents) is NO LONGER BLOCKED — the admin key
was verified to carry admin.events.read; only the pane is unbuilt. Coverage:
REST 11/40.

tests/test_tui.py

@@ -3235,3 +3235,98 @@ class TestSessionToolsHydration:
             await pilot.pause()
         joined = " ".join(_text_of(w) for w in writes)
         assert "session_tools_hydration_failed" in joined
+
+
+class TestBifrostStateHydration:
+    """get_session_bifrost + the #176 BifrostState pane (GET /admin/sessions/{id}/bifrost)."""
+
+    @staticmethod
+    def _mute_tools(monkeypatch: pytest.MonkeyPatch) -> None:
+        """Neutralize the on_mount Tools-pane worker so it makes no real call."""
+        import ratatoskr.tui as tui_mod
+
+        async def noop(client, session_id):
+            return {"agent_id": "x", "builtin_tools": [], "bifrost_tools": []}
+
+        monkeypatch.setattr(tui_mod, "get_session_tools", noop)
+
+    def test_format_bifrost_state(self) -> None:
+        """format_bifrost_state [unit]: connected / endpoint / caps / tools lines."""
+        from ratatoskr.tui import _format_bifrost_state
+
+        lines = _format_bifrost_state(
+            {
+                "endpoint_url": "https://b/mcp",
+                "consumer_id": "alice",
+                "connected": True,
+                "capabilities_granted": ["tools:call", "tools:read"],
+                "tools": [{"name": "bifrost.echo"}],
+            }
+        )
+        joined = "\n".join(lines)
+        assert "connected=True" in joined
+        assert "consumer=alice" in joined
+        assert "https://b/mcp" in joined
+        assert "tools:call, tools:read" in joined
+        assert "bifrost.echo" in joined
+
+    async def test_hydrate_no_admin_key(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        """hydrate_no_admin_key [scenario]: admin_key None → 'not configured' + skip audit."""
+        self._mute_tools(monkeypatch)
+        writes = _spy_writes(monkeypatch)
+        app = _resolved_app(_args_existing(session_id="s-bf-1"))  # admin_key defaults None
+        async with app.run_test() as pilot:
+            await pilot.pause()
+            await app._hydrate_bifrost_state()
+            await pilot.pause()
+        joined = " ".join(_text_of(w) for w in writes)
+        assert "admin key not configured" in joined
+        assert "bifrost_state_skipped" in joined
+
+    async def test_hydrate_success(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        """hydrate_success [scenario,tracer]: 200 → binding in BifrostState pane + audit."""
+        import ratatoskr.tui as tui_mod
+
+        self._mute_tools(monkeypatch)
+        writes = _spy_writes(monkeypatch)
+
+        async def fake_bifrost(client, session_id, *, admin_key):
+            return {
+                "endpoint_url": "https://b/mcp",
+                "consumer_id": "alice",
+                "connected": True,
+                "capabilities_granted": ["tools:call"],
+                "tools": [{"name": "bifrost.echo"}],
+            }
+
+        monkeypatch.setattr(tui_mod, "get_session_bifrost", fake_bifrost)
+        app = _resolved_app(_args_existing(session_id="s-bf-2", admin_key="ak"))
+        async with app.run_test() as pilot:
+            await pilot.pause()
+            await app._hydrate_bifrost_state()
+            await pilot.pause()
+        joined = " ".join(_text_of(w) for w in writes)
+        assert "bifrost binding" in joined
+        assert "bifrost.echo" in joined
+        assert "bifrost_state_hydrated" in joined
+
+    async def test_hydrate_404_not_bound(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        """hydrate_404_not_bound [error]: 404 → 'not bound to Bifrost' + audit; no crash."""
+        import ratatoskr.tui as tui_mod
+        from ratatoskr.sessions import SessionApiFailed
+
+        self._mute_tools(monkeypatch)
+        writes = _spy_writes(monkeypatch)
+
+        async def not_bound(client, session_id, *, admin_key):
+            raise SessionApiFailed(status=404, body=b"session_not_bifrost_bound")
+
+        monkeypatch.setattr(tui_mod, "get_session_bifrost", not_bound)
+        app = _resolved_app(_args_existing(session_id="s-bf-3", admin_key="ak"))
+        async with app.run_test() as pilot:
+            await pilot.pause()
+            await app._hydrate_bifrost_state()
+            await pilot.pause()
+        joined = " ".join(_text_of(w) for w in writes)
+        assert "not bound to Bifrost" in joined
+        assert "bifrost_state_unavailable" in joined