feat(#20): admin (bifrost inspection + admin-events stream) onto the wt adapter (slice-6)

Slice-6 of the worldtree-sdk cutover: migrate the two admin routes off the
hand-rolled paths onto the `ratatoskr.wt` adapter over `client.admin.*`, and delete
the retired code. Both are web-only (the coverage-map's `tui.py` rows were stale —
corrected to `web/server.py`).

Adapter (`wt.py`): `get_session_bifrost` → `client.admin.sessions.bifrost` (open-world
dict verbatim, any error → SessionApiFailed default); `stream_admin_events` →
`client.admin.stream_events`, re-wrapping the SDK's `AdminEvent` → ratatoskr's at the
boundary.

Decisions (contract § slice-6 notes):
- Admin auth moves from a per-call `Authorization` header override to the client's
  `admin_auth` (`_wt_client(admin_key=…)`, extended this slice) — the SDK's admin.*
  routes use the provider, not a header.
- `AdminEvent` re-wrap (chosen over yield-through): the SDK's `admin_id`(nan)/None-able
  `type`/`data` diverge from ratatoskr's `id`/`type`/`data` that the web filter reads;
  re-wrapping (nan→0, None→""/{}) degrades the open-world None/nan ONCE at the adapter
  and keeps the web endpoint + `_admin_event_matches_web` + the `AdminEvent` domain type
  unchanged (preserves the web surface). Rejected: yield SDK events + rewire the web
  filter (heavier churn, scattered hardening).
- Admin-stream error map: a NON-200 open raises `ApiError("admin_stream_failed")`
  (NOT `ConnectFailed`) → SseConnectFailed; `ConnectionDropped` (connect-time OR
  mid-stream/resumable-EOF) → SseConnectionDropped. The web integration test caught the
  ApiError-not-ConnectFailed gotcha the unit fake couldn't.

Web (`web/server.py`): both admin endpoints build the wt client with admin_key and call
`wt.*`; the bifrost endpoint gains ConnectFailed→502 handling (cutover foot-gun); the
admin-events endpoint closes the injected transport (INV-CUT-1), never the wt client.

Deleted the hand-rolled `sessions.get_session_bifrost` + `sse_client.stream_admin_events`
(+ orphaned httpx/httpx_sse/json/AsyncIterator imports); the ratatoskr `AdminEvent`
dataclass stays in `sse_client.py` (re-wrap target, imported by wt + web) until slice-7.
Retired `test_sse_client.py` entirely (its last test was the admin stream) and the
`test_sessions.py` `TestGetSessionBifrost`; added the slice-6 adapter tests.

LIVE SMOKE (:8081, readonly-admin key) — INV-CUT-5 / DEC-4 cleared: the web bifrost
endpoint returned an admin-authed clean 404 envelope (auth + route + mapping proven);
a real `session.created` admin event (id=32) re-wrapped cleanly on live wire (driven by
a session-create, throwaway session cleaned up).

Suite 490 green; ruff clean; mypy net-improved on web/server.py (16→12 pre-existing, no
new). Patch bump 0.21.18 → 0.21.19 (the cutover MINOR is deferred to slice-7, DEC-6).

tests/test_sessions.py

@@ -1,14 +1,13 @@
-"""Tests for ratatoskr.sessions per docs/contracts/issues/2.contract.md."""
+"""Tests for ratatoskr.sessions per docs/contracts/issues/2.contract.md.
+
+Post worldtree-sdk cutover the `sessions` module is down to `endpoint_for_plane`
+(the Bifrost provider-plane helper) + the caller-semantic exception classes the
+`ratatoskr.wt` adapter raises; every wire wrapper has retired onto the SDK adapter
+(the wrappers' tests live in `test_wt.py`)."""
 
-import httpx
 import pytest
-import respx
 
-from ratatoskr.sessions import (
-    SessionApiFailed,
-    endpoint_for_plane,
-    get_session_bifrost,
-)
+from ratatoskr.sessions import endpoint_for_plane
 
 
 class TestEndpointForPlane:
@@ -30,65 +29,3 @@ class TestEndpointForPlane:
         """unknown_plane [adversarial]: any other plane → ValueError (PRE-001)."""
         with pytest.raises(ValueError):
             endpoint_for_plane("persona", "10.100.10.50")
-
-
-class TestGetSessionBifrost:
-    """#2 contract — get_session_bifrost (GET /admin/sessions/{id}/bifrost, #176)."""
-
-    @respx.mock
-    async def test_happy_uses_admin_bearer(self) -> None:
-        """happy [happy,tracer]: 200 → binding dict; request carries the ADMIN bearer (override)."""
-        route = respx.get("https://w.example/admin/sessions/s1/bifrost").mock(
-            return_value=httpx.Response(
-                200,
-                json={
-                    "endpoint_url": "https://bifrost.example/mcp",
-                    "consumer_id": "alice",
-                    "connected": True,
-                    "capabilities_granted": ["tools:call", "tools:read"],
-                    "tools": [{"name": "bifrost.alice.echo", "description": "echo"}],
-                },
-            )
-        )
-        async with httpx.AsyncClient(
-            base_url="https://w.example",
-            headers={"Authorization": "Bearer consumer-key"},
-        ) as client:
-            state = await get_session_bifrost(client, "s1", admin_key="admin-xyz")
-        assert state["connected"] is True
-        assert state["tools"][0]["name"] == "bifrost.alice.echo"
-        # the request overrode the client's default consumer bearer with the admin key
-        assert route.calls[0].request.headers["Authorization"] == "Bearer admin-xyz"
-
-    @respx.mock
-    async def test_403_scope_denied(self) -> None:
-        """403 [error]: admin key lacks admin.sessions.read → SessionApiFailed(403)."""
-        respx.get("https://w.example/admin/sessions/s1/bifrost").mock(
-            return_value=httpx.Response(403, json={"error_code": "auth_scope_denied"})
-        )
-        async with httpx.AsyncClient(base_url="https://w.example") as client:
-            with pytest.raises(SessionApiFailed) as exc:
-                await get_session_bifrost(client, "s1", admin_key="k")
-        assert exc.value.status == 403
-
-    @respx.mock
-    async def test_404_not_bound(self) -> None:
-        """404 [error]: session_not_bifrost_bound → SessionApiFailed(404)."""
-        respx.get("https://w.example/admin/sessions/s1/bifrost").mock(
-            return_value=httpx.Response(404, json={"error_code": "session_not_bifrost_bound"})
-        )
-        async with httpx.AsyncClient(base_url="https://w.example") as client:
-            with pytest.raises(SessionApiFailed) as exc:
-                await get_session_bifrost(client, "s1", admin_key="k")
-        assert exc.value.status == 404
-
-    @respx.mock
-    async def test_empty_admin_key_asserts(self) -> None:
-        """empty_admin_key [adversarial]: '' → AssertionError; no HTTP issued."""
-        route = respx.get("https://w.example/admin/sessions/s1/bifrost").mock(
-            return_value=httpx.Response(200, json={})
-        )
-        async with httpx.AsyncClient(base_url="https://w.example") as client:
-            with pytest.raises(AssertionError):
-                await get_session_bifrost(client, "s1", admin_key="")
-        assert route.call_count == 0