feat: _atmos-control canonical domain-control record, admin operations UI, and log-audit hardening