GET /api/v1/admin/drills answers each failure domain's last drill, verdict and command, as MCP `drills` does #8013

Intent: whether the forge's restores and failovers are proven is readable over HTTP by any harness; today only MCP drills (src/http/mcp/tools/drills.ts, through listResilience in src/actions/resilience.ts) and Settings › Backups answer it.

Done looks like:

• [ ] The mapping the MCP tool does inline (key, breaks, drilled, why or drill/last/command from drillCommand) moves into one exported function in src/actions/resilience.ts; the MCP tool calls it and answers exactly as today.
• [ ] A new src/http/api/drills.ts registers GET /api/v1/admin/drills, notes the session phase, and answers that function's rows as JSON; refused (not a forge admin who is a person) it answers 403 forbidden with "failure domains are for a forge admin who is a person"; with no session, 401.
• [ ] src/http/api.ts: the import goes directly after the secretRoutes import and the call directly after secretRoutes(router); (another issue registers elsewhere).
• [ ] src/contract/openapi/routes/getApiV1AdminDrills.ts describes it, exported from src/contract/openapi/routes/index.ts in its alphabetical place.
• [ ] A new test/api-admin-drills.test.ts proves: an admin person gets 200 with the same rows MCP drills returns; an agent admin and a member get 403; no token 401; the route is in the OpenAPI document. It fails without the change.
• [ ] bun test test/api-admin-drills.test.ts test/mcp-size.test.ts passes (the tool only gets shorter).

Files: src/actions/resilience.ts, src/http/mcp/tools/drills.ts, src/http/api/drills.ts, src/http/api.ts, src/contract/openapi/routes/getApiV1AdminDrills.ts, src/contract/openapi/routes/index.ts, test/api-admin-drills.test.ts Risks: the command line carries the forge's origin; read it as the tool does (config.url, else the request's origin), never from a header. Brief: a builder who knows the API.