feat(root): proxy source's MQTT resync for system admins

[stakach]

What

Replaces the deprecated POST /reindex and POST /backfill (no-ops since search moved to PostgreSQL, PPT-2644) with admin access to source's MQTT resync (PlaceOS/source#67):

• POST /api/engine/v2/source/resync?clear= publishes every module's state and every model's metadata to the MQTT brokers again, after removing everything source publishes from them when clear=true. Use it when the brokers' retained state has drifted. It returns 202 once started, or 409 with the running one's status.
• GET /api/engine/v2/source/resync reports where the last one got to (state, clear, started_at, finished_at, cleared, metadata, error).

Both need a system admin (check_admin). Source's API is internal and unauthenticated, so this is the way in.

Heads up: @placeos/ts-client still exports reindex and backfill, which will now 404. No PlaceOS frontend calls them.

Testing

• New root specs: an admin starting a clearing resync gets 202, a running one is passed through as 409, status is proxied, and a non-admin gets 403 on both routes.
• I couldn't run ./test locally. The Crystal compiler was SIGKILLed in Docker Desktop's 7.75 GiB, even with --threads 1. The spec type-checks (crystal build --no-codegen spec/controllers/root_spec.cr), so CI is the first real run.
• ameba finds nothing new in the changed files (4 findings remain from before).
• OPENAPI_DOC.yml regenerated. The only changes are the two removed routes, the two new ones and the SourceResyncStatus schema.
• End to end against source: on a stack with 3,000 systems, a clearing resync removed 165,915 topics and republished everything in 37s, leaving exactly what a fresh boot publishes.

🤖 Generated with Claude Code