feat(admin): exclude admin traffic from usage statistics

Operator directive (progress ledger, 2026-08-21): admin requests must
not touch req/min-req/day statistics. handleAdminAPI no longer calls
checkAndCount for GET /admin/api/overview or GET /admin/api/usage (it
already skipped it for GET /admin/api/usage/history) - admin traffic
must never appear in usage statistics, which measure real LLM traffic
only. identify()'s group return is now discarded (u, _, ok :=), since
buildLimitScopes is no longer built here.

Direct consequence, documented in the new doc comment: an admin's own
requestsPerMinute/requestsPerDay limit, if configured, is no longer
enforced against admin-route traffic either - accepted trade-off
(admin-gated, cheap reads; a self-inflicted, not shared, resource
cost).

admin_test.go: TestAdmin_RateLimitApplies (asserted a 2nd request
429s) inverted to TestAdmin_NeverRateLimitedAndCountersUntouched - 5x
requests to both overview and usage against an admin key pinned at
RequestsPerMinute:1, asserting every one is 200 and the admin's own
req/min counter stays exactly 0.

integration/integration_test.go: TestAdmin_Dashboard's admin-user
assertion inverted from requestsPerDay > 0 ("admin API calls count
too") to requestsPerDay == 0 ("admin routes never call
checkAndCount") - the admin key is used throughout the whole suite
exclusively to hit /admin/api/*, so it must show exactly 0 despite
issuing many requests by the time this test runs.

integration/integration_test.go

@@ -949,10 +949,13 @@ func TestAudioTranscriptions(t *testing.T) {
 // TestAdminDashboard covers v0.2 integration coverage (spec §4): the
 // unauthenticated HTML shell carries no data, the two JSON routes gate
 // on admin vs. non-admin vs. unauthenticated, and GET /admin/api/usage
-// reflects the traffic this suite has generated by the time this test
-// runs — deliberately placed near the end of the file (Go runs tests in
-// source order with no -shuffle in this suite's Makefile target) so
-// alice's own request counters are already non-zero.
+// reflects the REAL LLM traffic this suite has generated by the time this
+// test runs — deliberately placed near the end of the file (Go runs
+// tests in source order with no -shuffle in this suite's Makefile
+// target) so alice's own request counters are already non-zero. It also
+// asserts the stats-exclusion directive's other half: the admin key
+// itself, used throughout this suite only to call /admin/api/* routes,
+// must show exactly 0 requestsPerDay — admin traffic is never counted.
 func TestAdminDashboard(t *testing.T) {
 	pageReq, err := http.NewRequest(http.MethodGet, traefik1URL+"/admin", nil)
 	if err != nil {
@@ -995,11 +998,18 @@ func TestAdminDashboard(t *testing.T) {
 
 	aliceUsage := adminUsageEntry(t, "users", "alice")
 	if reqDay, _ := aliceUsage["requestsPerDay"].(float64); reqDay <= 0 {
-		t.Errorf("alice requestsPerDay = %v, want > 0 (this suite's own earlier traffic)", reqDay)
+		t.Errorf("alice requestsPerDay = %v, want > 0 (this suite's own earlier real-LLM traffic)", reqDay)
 	}
+	// Stats-exclusion directive (progress ledger, 2026-08-21): admin routes
+	// never call checkAndCount, so the admin key — used throughout this
+	// suite ONLY to call /admin/api/* (adminUsageEntry/adminUsageHistory,
+	// plus this test's own overview/usage calls above) — must show exactly
+	// 0 requestsPerDay despite having issued many requests by this point in
+	// the run. This inverts the pre-directive assertion here, which
+	// expected admin's own admin-API calls to count like any other route.
 	adminUsage := adminUsageEntry(t, "users", "admin")
-	if reqDay, _ := adminUsage["requestsPerDay"].(float64); reqDay <= 0 {
-		t.Errorf("admin requestsPerDay = %v, want > 0 (this test's own admin API calls count too)", reqDay)
+	if reqDay, _ := adminUsage["requestsPerDay"].(float64); reqDay != 0 {
+		t.Errorf("admin requestsPerDay = %v, want 0 (admin routes never call checkAndCount)", reqDay)
 	}
 
 	// v0.2 data-layer task: GET /admin/api/usage/history's hour series for