Expose latest Runtime Adapter Compute inventory through a read-only admin API

[tiammomo]

Summary

The control plane needs an authenticated representation of registered Runtime Adapters and their latest accepted Compute Node/GPU observations. Returning the external adapter wire document directly from unrelated routes would couple admin clients to collector internals and make freshness, authorization, and error handling inconsistent.

Actual behavior

Even after collection is implemented, operators have no supported HTTP endpoint to inspect adapter availability, server-derived freshness, observation timestamps, nodes, or GPUs. The persisted snapshot API is crate-private and the dashboard cannot consume it.

Expected behavior

ModelPort exposes a versioned, read-only admin API that lists configured adapters and returns the latest validated Compute inventory with server-owned freshness. It uses existing admin authentication, never exposes credentials or secret references, keeps responses deterministic and bounded, and defines unavailable/stale behavior independently from upstream health.

Steps to reproduce

Collect or persist a valid Runtime Adapter Compute snapshot and call the existing admin API surface; there is no route that returns adapter or GPU inventory.

Environment

ModelPort after #25, #27, and #29. Up to 64 configured Runtime Adapters with immutable Compute snapshots in memory or PostgreSQL.

Acceptance criteria

• Add an admin-authenticated deterministic list endpoint for configured Runtime Adapters and a detail endpoint for the latest Compute inventory of one adapter.
• Define a versioned ModelPort-owned response envelope that includes adapter ID, fresh/stale/unavailable state, age and observation/acceptance timestamps, and the validated v1alpha1 inventory document when available.
• Derive freshness at request time from server time and each trusted registry stale-after policy; never write freshness into or mutate the stored Runtime Adapter document.
• Return bounded, stable errors for invalid or unknown adapter IDs and fail closed if persisted data cannot be revalidated.
• Require the existing admin read authorization and no-store cache policy; never expose Bearer credentials, Authorization headers, credential environment-variable names, or raw upstream failures.
• Keep list ordering deterministic and responses bounded by the registry maximum; add memory/PostgreSQL state tests and admin authorization, redaction, unavailable, fresh, and stale route tests.
• Update the OpenAPI/admin contract and operator documentation without adding dashboard components in this slice.
• Exclude collection scheduling, adapter mutations, model deployment actions, GPU allocation, retention, provider routing, provider-specific adapters, and local-inference-stack integration.