Operator Surface
Admin API routes are isolated under `/api/v1/admin/*`; user DApp routes stay under `/api/v1/*`.
周周期 sync 只能通过管理员会话触发。