chore(web): library-admin inline script moves to admin.ts; rendering guardrail

The library admin page carried an inline <script> block of global
functions (toggleLibraryPanel, openEditModal, openDeleteModal,
openFolderBrowser plus the delete-modal close listener). They move into
the admin Alpine component as typed methods; the page body gains
x-data="admin" and the call sites switch onclick= -> @click.
Behavior unchanged.

Guardrail: make lint-rendering (wired into make test) fails when a
web/src file builds more HTML template literals than its recorded
baseline (web/src/rendering-allowlist.txt, seeded at 18 sites across 9
files post-twin-deletion) or when a .templ file gains an inline script
block. theme_flash_guard.templ is the only sanctioned inline script;
web/src/reader is a sanctioned island.

theme.ts: Array.from(classList) — DOMTokenList spread needs
lib.dom.iterable, which the tsconfig does not include.

web/src/rendering-allowlist.txt

@@ -0,0 +1,15 @@
+# Rendering-ownership baseline (AGENTS.md → Rendering ownership).
+# Files allowed to build HTML via template literals, with their current
+# site counts. `make lint-rendering` fails when a count grows above its
+# baseline. Shrink counts as fragments move to templ partials — the end
+# state of the triage is an empty list. The reader (web/src/reader/) is a
+# sanctioned island and not counted here.
+web/src/admin.ts:1
+web/src/api-explorer.ts:2
+web/src/collections.ts:1
+web/src/custom-section-builder.ts:2
+web/src/linking.ts:1
+web/src/search.ts:3
+web/src/stats.ts:6
+web/src/toast.ts:1
+web/src/unlinked_books.ts:1