refactor(addie): split admin routing into bounded domains

[bokelley]

Summary

• split the legacy 66-tool admin surface into seven router-visible domains of 5–12 existing named tools
• stop attaching the monolithic admin set to every admin DM and admin channel turn
• preserve the exact legacy set as a hidden compatibility shim for already-created plans
• keep handlers, schemas, authorization, confirmations, and audit behavior unchanged
• extend the checked-in tool inventory, compact catalog generator, and strict router corpus for the new domains

This takes the bounded named-tool approach: there is no arbitrary tool-name dispatcher or new mutation path.

Measured exposure

• normal admin knowledge route: 137 → 73 tools (47% reduction)
• schema bytes: 98,083 → 57,217 (42% reduction)
• each new admin domain contains at most 12 domain tools
• the all-valid adversarial maximum and legacy compatibility profile remain explicitly measured

Verification

• npm run test:addie-tools
• focused Addie routing/safety suite: 68 tests passed
• root unit suite: 1,056 tests passed
• npm run typecheck
• push-time version, changeset, docs-link, and Mintlify navigation checks passed

The repository precommit wrapper reached its fixed 600-second limit while running the full server suite. A separate run identified only an unrelated unchanged storyboard E2E test hitting its own fixed 30-second timeout; CI is the authoritative full-suite gate.

Part of #6845

[aao-secretariat]

Ladon verdict: Approve

Approve — Addie tool-set refactor with no blocking or medium findings.

This PR splits Addie's monolithic 66-tool admin set into seven bounded router-visible domains, stops the always-append of the full admin surface on every admin turn, and keeps the exact legacy union as a hidden compatibility shim (routerVisible: false) for already-created plans. The reviewer verified reachability is preserved: 56 tools land in the new domains, the remaining 10 (billing + outreach) stay reachable through existing router-visible sets (56+4+6=66), and no tool is orphaned to the hidden set. The routerVisible filter is applied consistently across getUnavailableSets, getValidToolSetNames, getToolSetDescriptionsForRouter, the reference/inventory generators, and snapshot reconciliation; live router output requesting the hidden admin set fail-closes at router.ts:855. Tests assert exact 66-tool preservation, the ≤12-tool domain bound, non-admin rejection, and the continuity shim.

This is an App/Addie-only PR (server/src/addie, scripts, docs/aao) — no protocol surface (static/schemas/source, docs/reference, dist) is touched, so the absence of a changeset is correct, not a gap.

high_risk is true only because modified files match server/src/addie/**, but the reviewer surfaced no medium-or-higher concerns on those modifications, so the flag is a look-closer signal that has been discharged. gated_paths is false. No no-auto-approve team match. No findings.

Decision table: rows 1–8 do not fire (no critical/high/medium findings, gated_paths false, no deletions, no medium on modified high-risk files, no prior escalation, no team gate, fewer than three mediums). Falls through to row 9 → approve.