feat(fm): partner registration admin API (#20)

loses #20 (closed)

Partners could only be created by a direct SQL insert, so the federation-lifecycle proxy and the startup bootstrap had nothing to act on. This adds the internal admin API from the FM requirements (internal admin API section, REQ-FED-19).

flowchart LR
  Op[Operator / Helm Job] -- "POST/GET/PATCH /internal/partners" --> FM
  FM -- "insert / update" --> DB[(partner_ops)]
  DB -- "list_active()" --> Boot[startup bootstrap]
  DB -- "resolve partnerOpId" --> Proxy["/internal/partners/{id}/federations/*"]

Endpoints

Method	Path	Result
POST	/internal/partners	201; 409 if the mcc_mnc or oauth2_client_id is already registered
GET	/internal/partners	list
GET	/internal/partners/{id}	detail; 404 if unknown
PATCH	/internal/partners/{id}	partial update; mcc_mnc is immutable

There's no DELETE: the spec retires partners through status so the audit history is kep