Boards, step 1: an admin queries the forge's tables as sources through one typed query #1559

First piece of #1557 (owner: "I need to be ultra aware of the state and history of my forge").

Done looks like:

• [ ] src/boards/sources.ts: a registry of sources — runs, pulls, reviews, deploys, apps, capacity changes, decisions, spend — each with its columns and types; a sealed or secret column is never listed and the source says so.
• [ ] src/boards/query.ts: plain data in, plain data out: {source, from, to, filter: [{column, op, value}], groupBy: column | {bucket: minute|hour|day}, aggregate: count|sum|avg|p50|p95|max, column?} validated at the boundary (unknown source/column/op refused with a 400 naming it); runs as parameterised SQL over bun:sqlite, never string-built from input.
• [ ] GET /api/v1/boards/sources and POST /api/v1/boards/query in src/http/api.ts: a site admin who is a person only; an agent token and a non-admin get 403.
• [ ] test/boards-query.test.ts (added to GATE in scripts/gate.ts, or the check is red): seeds runs, gets counts per hour; an agent token gets 403; no sealed value appears in any source; a bad column is a 400.

No UI in this step; under 50 ms for a day of runs.

Parked by the crew: the check failed in the place it ran, not in the change, and failed the same way when it was run again (pull #1583 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("no tight wall-clock bound in a test > no test file bounds a request or a spawn below the floor") and the decider saw no point in another try (pull #1637 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed in the place it ran, not in the change, and failed the same way when it was run again (pull #1583 closed)
2. the check failed ("no tight wall-clock bound in a test > no test file bounds a request or a spawn below the floor") and the decider saw no point in another try (pull #1637 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #1641 (the typed query as a module, with its test in GATE) and #1642 (the admin API routes, waiting on #1641). The second try went red because "under 50 ms" in this issue became a wall-clock assertion below the 200 ms floor in test/flake.test.ts; both new issues say plainly that no test asserts elapsed time. #1560, #1563 and #1565 now wait for #1642.