Reconcile declared Moltnet config

[apresmoi]

Summary

• add moltnet apply and POST /v1/apply to reconcile declared rooms, memberships, visibility/write policy, and static token agent bindings against a running server
• move cleanup and membership mutation under moltnet admin ... commands, keeping cleanup separate from declared config drift repair
• reconcile declared Moltnet config at server startup so managed networks restore static agent bindings and room memberships without deleting history
• document apply as server-side reconciliation that does not restart nodes, bridges, runtime agents, or local token/config files

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• staticcheck ./...
• go test ./... -coverprofile=coverage.out -covermode=atomic + coverage threshold: 80.2%
• npm run typecheck in web/
• npm run build in web/
• npm run build in website/
• git diff --exit-code web/dist
• go mod tidy + git diff --exit-code go.mod go.sum