refactor: move Vantage HQ out to the vantage-admin repository

admin/ and adminsite/ are extracted with their history to
gitea.hostxtra.co.uk/vantage/vantage-admin, where they are named server/
and web/ for what they are rather than for the services they run. Their
images move with them, to vantage/vantage-admin/{server,web}.

Nothing here imported them, so the cut is clean: the only coupling was
always at runtime, through admin writing into the control plane's
database. The parts of that contract this side enforces are unchanged and
still documented here — hq-sourced users, POST /license answering 409
cloud_managed, and FREE_INSTANCE_REAP_AFTER needing to match.

LICENSE_SIGNING_KEY now appears in no compose file in this repository.
Keeping it out used to be a rule someone had to remember; it is the
repository boundary now.

docker-compose.site.yml loses both services and gains a note on how the
host composes the three files together.

.gitea/workflows/server-deploy.yml

@@ -86,14 +86,12 @@ jobs:
                   # in that same push to trigger a rebuild.
                   flag server    '^(server/|proto/|default_steps/|go\.work)'
                   flag sitesvc   '^(sitesvc/|go\.work)'
-                  flag admin     '^(admin/|go\.work)'
 
                   # The three Next images and the docs site use their own
                   # directory as the build context, so nothing outside it can
                   # affect them.
                   flag web       '^web/'
                   flag site      '^site/'
-                  flag adminsite '^adminsite/'
                   flag docsite   '^docsite/'
 
             # vantage-shared is private, so every Go build below needs a
@@ -178,28 +176,6 @@ jobs:
                     -t "$IMAGE" -f sitesvc/Dockerfile sitesvc/
                   docker push "$IMAGE"
 
-            - name: Build and push admin image
-              if: steps.changed.outputs.admin == 'true'
-              run: |
-                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/admin:latest"
-                  docker build --secret id=netrc,src="$HOME/.netrc" \
-                    -t "$IMAGE" -f admin/Dockerfile admin/
-                  docker push "$IMAGE"
-
-            - name: Build and push adminsite image
-              if: steps.changed.outputs.adminsite == 'true'
-              run: |
-                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/adminsite:latest"
-                  docker build \
-                    --build-arg NEXT_PUBLIC_ADMIN_API_URL="${{ vars.ADMIN_API_URL }}" \
-                    --build-arg NEXT_PUBLIC_ADMIN_ENV="${{ vars.ADMIN_ENV }}" \
-                    --build-arg NEXT_PUBLIC_PADDLE_CLIENT_TOKEN="${{ vars.PADDLE_CLIENT_TOKEN }}" \
-                    --build-arg NEXT_PUBLIC_PADDLE_ENV="${{ vars.PADDLE_ENV }}" \
-                    --build-arg NEXT_PUBLIC_SITE_URL="${{ vars.SITE_URL }}" \
-                    -t "$IMAGE" \
-                    -f adminsite/Dockerfile adminsite/
-                  docker push "$IMAGE"
-
             - name: Build and push docsite image
               if: steps.changed.outputs.docsite == 'true'
               run: |