Admin routes: children CRUD over the core business layer

Task e4845baa (feature 16, NestQuest API service): the admin PWA needs
to manage the children registry, but the only removal path the domain
allows is deactivation and the name/NULL/bool/permutation policies all
live in core.children — so the plane gets thin adapters that forward
each request to ONE core call and never re-implement a rule.

WHY: create/edit/set_active/reorder (+ a thin GET list) hang off the
router's ONE require_admin dependency; edit forwards only the fields
the request supplied (exclude_unset) so an omitted field stays
unchanged while an explicit null is rejected by the core rather than
silently ignored. Core ValueErrors map to 404 (non-existent child) or
422 (invalid input, same class Pydantic reports) and are documented in
the module docstring; the core rejects before any write, so neither
status can leave a half-applied change.

The admin JWT test harness (local RSA keys, stubbed JWKS, token
minting, app runner) is factored into tests/admin_jwt_harness.py so
the children route tests reuse it instead of duplicating it; the auth
tests import the same harness with unchanged test bodies, and the
shared temp_db_path/admin_client fixtures now live in conftest.py.

TZ=UTC uv run pytest -q: 1669 passed (baseline 1652 + 17 new).

api/nestquest_core.py

@@ -124,8 +124,13 @@ core_events = importlib.import_module(f"{_CORE_MODULE_NAME}.events")
 #: the snapshot builder's ``settings`` parameter takes.
 core_settings = importlib.import_module(f"{_CORE_MODULE_NAME}.settings")
 
+#: The children business layer (``core.children.create_child`` et al.)
+#: the admin plane's children routes call.
+core_children = importlib.import_module(f"{_CORE_MODULE_NAME}.children")
+
 __all__ = [
     "core",
+    "core_children",
     "core_completion",
     "core_db",
     "core_events",