GET /api/v1/admin/subscriptions answers the crew's Claude accounts with scopes, budget and spend, never a token, as MCP `subscriptions` does #8021

Intent: a forge admin's harness can see what the crew runs on over HTTP; today only MCP subscriptions (src/http/mcp/tools/subscriptions.ts), the terminal and the settings page answer it.

Done looks like:

• [ ] The rows the tool builds (id, name, kind, apiBase, scopes, budgetUsd, spentUsd, restingUntil, restingSaid, lastUsedAt) come from one exported function, subscriptionRows(db) in src/core/subscriptions.ts; the MCP tool calls it and answers exactly as today.
• [ ] A new src/http/api/subscriptions.ts registers GET /api/v1/admin/subscriptions: a forge admin gets { items }; anyone else signed in gets 403 forbidden; no session gets 401, as the other /api/v1/admin/* reads answer.
• [ ] No answer carries a token or any field the tool does not already show.
• [ ] src/http/api.ts: the import goes directly after the agentRoutes import and the call directly after agentRoutes(router); (other issues register elsewhere).
• [ ] src/contract/openapi/routes/getApiV1AdminSubscriptions.ts describes it, exported from src/contract/openapi/routes/index.ts in its alphabetical place.
• [ ] A new test/api-admin-subscriptions.test.ts proves: an admin gets the same rows MCP subscriptions returns; the JSON never contains the seeded token's text; a member gets 403; no token 401; the route is in the OpenAPI document. It fails without the change.

Files: src/core/subscriptions.ts, src/http/mcp/tools/subscriptions.ts, src/http/api/subscriptions.ts, src/http/api.ts, src/contract/openapi/routes/getApiV1AdminSubscriptions.ts, src/contract/openapi/routes/index.ts, test/api-admin-subscriptions.test.ts Risks: read-only; waking, budgets and deleting stay MCP and the page. Brief: a builder who knows the API.