feat(docforge): slice 6c — template authoring page (frontend) (t-paliad-349)

The WYSIWYG authoring surface at /admin/templates (admin-gated page route):
  - templates-authoring.tsx — page shell (upload form, template list,
    workspace: palette / run-addressable preview / placed slots).
  - client/templates-authoring.ts — hydrates it: lists templates, uploads a
    .docx (multipart), renders the run-span preview, builds the variable
    palette from the Go catalogue (GET /api/docforge/variables), and wires
    the select-then-pick gesture: select text within one .docforge-run, click
    a palette variable → POST the slot → re-render with the response. Reuses
    the docforge-editor lib (escapeHtml, catalogue client). Cross-run
    selections rejected with a hint (v1: single-run text slots).
  - build.ts emits dist/templates-authoring.html + bundles the client.
  - handleTemplatesAuthoringPage serves the shell; GET /admin/templates
    registered under adminGate.
  - 12 i18n keys (DE+EN) for the page; i18n-keys.ts regenerated (3079).

Verification: go build/vet/test green (13 pkgs); bun run build.ts clean
(i18n scan passes); bun test 274/274; gofmt-clean. The docx surgery + store
+ catalogue are unit/live-tested. VERIFICATION CEILING: the integrated live
flow (upload→render→select→inject→save in a browser) needs the app running
with DATABASE_URL + Supabase auth + Playwright — verified post-merge, not in
this env.

m/paliad#157

internal/handlers/handlers.go

@@ -758,6 +758,7 @@ func Register(mux *http.ServeMux, client *auth.Client, giteaAPIToken string, svc
 		// t-paliad-349 docforge slice 6 — template authoring surface
 		// (upload base .docx → place variable slots → save). Admin-only,
 		// firm-shared catalog like submission_bases.
+		protected.HandleFunc("GET /admin/templates", adminGate(users, gateOnboarded(handleTemplatesAuthoringPage)))
 		protected.HandleFunc("GET /api/admin/templates", adminGate(users, handleListTemplates))
 		protected.HandleFunc("POST /api/admin/templates", adminGate(users, handleUploadTemplate))
 		protected.HandleFunc("GET /api/admin/templates/{id}", adminGate(users, handleGetTemplateAuthoring))

internal/handlers/templates.go

@@ -103,6 +103,12 @@ func requireTemplateStore(w http.ResponseWriter) bool {
 	return true
 }
 
+// handleTemplatesAuthoringPage serves the authoring page shell. The client
+// bundle hydrates the list, upload, preview, palette, and slots.
+func handleTemplatesAuthoringPage(w http.ResponseWriter, r *http.Request) {
+	http.ServeFile(w, r, "dist/templates-authoring.html")
+}
+
 // handleListTemplates backs GET /api/admin/templates.
 func handleListTemplates(w http.ResponseWriter, r *http.Request) {
 	if !requireTemplateStore(w) {