refactor: drop toast + over-engineered extras, add inline admin feedback

Phase 1 cleanup of the personal-site revamp. Backend/architecture untouched;
changes are limited to removing unused complexity and restoring feedback.

Removals
- Toast system: delete react-hot-toast, Toaster, QueryToastBridge, lib/toast,
  the toggle/easter-egg calls, related i18n keys and the dependency.
- Contact protection: remove Turnstile + per-IP rate limiting
  (lib/contact-guard, lib/contact-protection, admin screen, form widget,
  app-config wiring, nav entry, test).
- Speculative specs: delete orders, products, downloads, project-inquiry.

Inline feedback (replaces toast, no new deps)
- Add lib/admin-feedback (withFlash/readFlash) and components/admin/admin-flash,
  rendered centrally by AdminDashboardShell.
- Emit success/error messages for media, site-settings, portfolio, smtp,
  marquee and maintenance actions; pages read them via searchParams.
- Contact form shows validation/delivery errors inline; success still
  redirects to /success.

Docs
- Fix stale paths in frontend-system-* (components/root -> components/admin,
  lib/root-navigation -> lib/admin-navigation, drop phantom src/) and remove
  contact-protection references from docs and CLAUDE.md.
- Add docs/PHASE0_DIAGNOSIS.md (diagnosis report).

Note: proxy.ts self-fetch kept intentionally; it also drives maintenance mode.

tests/contact-protection.test.ts

@@ -1,65 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import {
-  buildDefaultContactProtectionSettings,
-  parseContactProtectionValue,
-  toContactProtectionFormValues,
-} from "../lib/contact-protection";
-
-describe("contact protection helpers", () => {
-  it("builds safe defaults", () => {
-    expect(buildDefaultContactProtectionSettings()).toEqual({
-      turnstile: {
-        enabled: false,
-        siteKey: "",
-        secretKey: "",
-      },
-      rateLimit: {
-        enabled: true,
-        maxRequests: 5,
-        windowMinutes: 10,
-      },
-    });
-  });
-
-  it("parses stored settings and trims keys", () => {
-    const settings = parseContactProtectionValue(
-      JSON.stringify({
-        turnstile: {
-          enabled: true,
-          siteKey: " 0x4AAAAA ",
-          secretKey: "secret",
-        },
-        rateLimit: {
-          enabled: true,
-          maxRequests: "8",
-          windowMinutes: "15",
-        },
-      }),
-    );
-
-    expect(settings.turnstile.enabled).toBe(true);
-    expect(settings.turnstile.siteKey).toBe("0x4AAAAA");
-    expect(settings.turnstile.secretKey).toBe("secret");
-    expect(settings.rateLimit.maxRequests).toBe(8);
-    expect(settings.rateLimit.windowMinutes).toBe(15);
-  });
-
-  it("hides the stored secret in form values", () => {
-    const values = toContactProtectionFormValues({
-      turnstile: {
-        enabled: true,
-        siteKey: "site-key",
-        secretKey: "secret-key",
-      },
-      rateLimit: {
-        enabled: true,
-        maxRequests: 5,
-        windowMinutes: 10,
-      },
-    });
-
-    expect(values.turnstile.secretKey).toBe("");
-    expect(values.turnstile.hasSecretKey).toBe(true);
-  });
-});