refactor: move Vantage HQ out to the vantage-admin repository

admin/ and adminsite/ are extracted with their history to
gitea.hostxtra.co.uk/vantage/vantage-admin, where they are named server/
and web/ for what they are rather than for the services they run. Their
images move with them, to vantage/vantage-admin/{server,web}.

Nothing here imported them, so the cut is clean: the only coupling was
always at runtime, through admin writing into the control plane's
database. The parts of that contract this side enforces are unchanged and
still documented here — hq-sourced users, POST /license answering 409
cloud_managed, and FREE_INSTANCE_REAP_AFTER needing to match.

LICENSE_SIGNING_KEY now appears in no compose file in this repository.
Keeping it out used to be a rule someone had to remember; it is the
repository boundary now.

docker-compose.site.yml loses both services and gains a note on how the
host composes the three files together.

docsite/Dockerfile

@@ -25,7 +25,7 @@ RUN npm run build
 
 # Runtime stage
 #
-# Docusaurus emits a fully static site, so unlike web/, site/ and adminsite/
+# Docusaurus emits a fully static site, so unlike web/ and site/
 # there is no Node server at runtime. alpine-slim is roughly a quarter the size
 # of caddy:alpine, and nothing here needs automatic TLS — the host proxy
 # terminates it.