feat(ui): E31 S4b — the admin pages behind one rail row, Configuration as a sectioned list, Statistics as tiles and bars

- NavRailGroup: one "Admin" rail row opening a panel of the admin pages (links, so a
  middle-click still opens a tab); the rail fits 133% zoom without a hidden scroll
- sysconfig.SECTIONS orders the config groups under four headings (every group in exactly
  one, test-held); the page shows them as Settings' side list (Tabs `group` headings);
  the lone registration group reads "Registration" under "Access"
- StatTiles / StatTile / StatBars: the Statistics overview's figures as tiles, the
  per-operation quota use as horizontal bars (a zero draws none)

backend/tests/test_sysconfig_registry.py

@@ -1,8 +1,10 @@
-"""The sysconfig registry: its order is the admin page's tab order, and a closed-set knob is a CHOICE.
+"""The sysconfig registry: a group's keys stay together, every group has its section, and a closed-set
+knob is a CHOICE.
 
 The admin Configuration page used to keep its own hand-written group order, which had already drifted
-(`explore` was missing, so its tab sorted last). The page now follows SPECS, so SPECS has to read in
-tab order: one run of keys per group.
+(`explore` was missing, so its tab sorted last). The page now follows the registry: SECTIONS orders the
+groups under their headings (E31), and a group missing there would fall off the page — so each group
+of SPECS sits in exactly one section.
 
 A closed-set admin knob is a CHOICE, not free text (E22 S2 follow-up).
 
@@ -22,7 +24,7 @@ from app.config import Settings, choices_of
 CHOICE_KEYS = {s.key for s in sysconfig.SPECS if s.type == "choice"}
 
 
-def test_each_group_is_one_run_of_keys_so_the_registry_reads_in_tab_order():
+def test_each_group_is_one_run_of_keys():
     runs = [
         s.group
         for i, s in enumerate(sysconfig.SPECS)
@@ -32,6 +34,13 @@ def test_each_group_is_one_run_of_keys_so_the_registry_reads_in_tab_order():
     assert runs[:2] == ["access", "email"]
 
 
+def test_every_group_sits_in_exactly_one_section():
+    listed = [g for _, members in sysconfig.SECTIONS for g in members]
+    assert len(listed) == len(set(listed)), listed
+    assert set(listed) == {s.group for s in sysconfig.SPECS}
+    assert [sid for sid, _ in sysconfig.SECTIONS] == ["access", "youtube", "media", "system"]
+
+
 def test_every_closed_set_knob_is_a_choice_whose_options_come_from_config():
     assert CHOICE_KEYS == {
         "search_source",
@@ -85,6 +94,14 @@ def test_describe_hands_the_picker_its_options():
     assert items["quota_daily_budget"]["choices"] == []
 
 
+def test_describe_lists_every_group_under_its_section_in_order():
+    d = sysconfig.describe(_FakeDb())
+    assert [s["id"] for s in d["sections"]] == ["access", "youtube", "media", "system"]
+    assert d["sections"][0]["groups"] == ["access", "google", "email"]
+    listed = [g for s in d["sections"] for g in s["groups"]]
+    assert sorted(listed) == sorted(d["groups"])
+
+
 def test_set_value_stores_the_canonical_spelling_and_refuses_anything_else(db):
     sysconfig.set_value(db, "search_source", "API")
     assert sysconfig.get_str(db, "search_source") == "api"