feat(admin): monitoring center

Sprint 26.

New features/admin/monitoring/ module + net-new /:lang/backoffice/monitoring
route + Dashboard Quick Action.

- Health section reuses AdminDashboardFacade.healthChecks directly (real
  data, unchanged since Sprint 19) instead of duplicating the logic
- unified AdminMonitoringEvent feed covering audit/security/login/
  failed-login/api/error/warning, category filter + search, 40 seeded
  synthetic entries (no logging backend exists anywhere in this system)
- mock queue depth/status cards, mock webhook delivery log
- intentionally kept separate from Sprint 24's per-transaction audit and
  Sprint 25's per-user audit - different scopes, no consolidation attempted

Also fixed a real type error: AdminDashboardQuickActionId's union was
missing 'users' and 'monitoring' (added when wiring those Quick Actions),
caught by ng build's template type-checking even though plain tsc --noEmit
passed - a reminder that ng build is the authoritative check here.

docs/ADMIN.md + docs/BACKEND.md (new item 15) updated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/SPRINT-PLAN.md

@@ -59,8 +59,9 @@ Notify user: **from Sprint 20 (Categories) once product↔category link + admin
 - [x] `docs/ADMIN.md` (new Sprint 25 section), `docs/BACKEND.md` item 14 added
 - Commit: `feat(admin): users and permissions`
 
-## Sprint 26 — Monitoring
-- [ ] Audit/security/login logs views (local), API/error/warning feed, queue/webhook placeholders, health page
+## Sprint 26 — Monitoring ✅ done
+- [x] Audit/security/login/failed-login logs (unified event feed, category filter), API/error/warning feed, queue/webhook mock views, health page (reuses real Sprint 19 healthChecks)
+- [x] `docs/ADMIN.md` (new Sprint 26 section), `docs/BACKEND.md` item 15 added
 - Commit: `feat(admin): monitoring center`
 
 ## Sprint 27 — Analytics