Admin-scoped firm disband/rename endpoints + service credential (treasury-rest-api)

Backend half of PAR-209 (economy-explorer admin firm tool). treasury-rest-api is the ledger-authoritative tier and already touches both Treasury accounts (AccountMapper) and the business firm/firm_accounts tables (FirmMapper), plus the idempotent POST /api/v1/transfers — so the disband/rename orchestration belongs here, called by the explorer.

Why this is blocked-by-design today

• Auth is HS256 JWT API keys (JwtTokenVerifier/JwtAuthFilter, signed by jwt-secret, minted by AuthService). The token model is VerifiedToken(keyId, ownerUuid, keyType, accountId, firmId) — there is no admin/scope/role claim, and write endpoints are firm-scoped (/firms/me); POST /transfers moves money only from the token's own account. So no current credential can disband an arbitrary firm.
• There are no admin endpoints and no account-archive endpoint (AccountController is read-only: balance / by-player / transactions).
• economy-explorer has no runtime client to treasury-rest-api (it reads MariaDB directly; lib/jwt.ts only mirrors AuthService.buildJwt to mint user keys). So the explorer→rest-api call path + credential must be built from scratch.

Scope

1. Admin scope in the token model. Add an admin/service scope claim (e.g. scope:["admin"] or a keyType=SERVICE) to the minted JWT + VerifiedToken + verifier, and gate the new endpoints on it (reject normal firm/owner keys). Keep it distinct from PERSONAL/BUSINESS/GOVERNMENT keys.
2. Endpoints (replicate FirmServiceImpl faithfully — see PAR-209 for the exact flow):
   • POST /api/v1/admin/firms/{firmId}/disband — resolve-or-create proprietor PERSONAL account; per firm account (firm_accounts WHERE removed_at IS NULL): transfer positive balance → proprietor personal (reuse the idempotent transfer service, requester/authorizer = proprietor, reason "Firm disbanded"), archive the Treasury account, soft-delete the firm_accounts link; then UPDATE firm SET is_archived=1, default_account_id=NULL. Return a per-account result (amount swept, dest account, idempotency key) for the caller's audit. Idempotent + resumable (skip already-archived/removed accounts).
   • POST /api/v1/admin/firms/{firmId}/rename — name rules from the plugin: length 2–32, regex [A-Za-z0-9 _.\-]{2,32}, no leading digit, case-insensitive uniqueness (allow case-only self-rename); UPDATE firm SET display_name=?.
   • Add the underlying account-archive operation (currently missing) through the service/AccountMapper (mark accounts.is_archived), not raw balance writes.
3. Service-layer + idempotency. Keep controller→service→mapper (note PAR-113). Every transfer carries an Idempotency-Key so retries can't double-pay; the disband is safe to re-run. Treasury IPC vs firm-table writes can't share one txn — log each step for reconciliation.
4. Rate-limit + server-side audit on the admin endpoints (they're privileged); log keyId + firmId + per-account results.

Credential scheme + dev/prod provisioning (the "set up credentials" ask)

Once (1) lands, provisioning is mechanical and per-env (no secret values need printing):

• Each env already has an HS256 jwt-secret (application-{uat,prod}.yaml → k8s app-secrets/equivalent in the treasury-rest-api dev & prod namespaces). Mint one long-lived admin-scoped service token per env, signed by that env's jwt-secret, persisted as an api_key row with the admin scope (so it's revocable/rotatable like any key, via the existing AuthService admin rotate).
• Store each env's token in a k8s secret consumed by economy-explorer in the matching env (dev → development ns, prod → prod ns), e.g. TREASURY_ADMIN_TOKEN + TREASURY_API_BASE_URL (the in-cluster rest-api service URL per env). economy-explorer gains a small server-only rest-api client (admin actions only) that sends Authorization: Bearer <token>.
• Rotation: reuse AuthService.adminForceRotate(keyId); re-write the k8s secret; restart/rollout the explorer.

⚠️ Sequencing: the admin scope must exist and validate first — minting/storing a privileged service token before (1) ships would put an unvalidated prod credential in place with nothing enforcing its scope. Provision the secrets in the same change that adds + gates the endpoints, across dev and prod together.

Acceptance

• A SERVICE/admin-scoped token can disband + rename any firm via the new endpoints; PERSONAL/BUSINESS/GOVERNMENT keys are rejected (403).
• Disband matches the plugin outcome (balances swept via ledger, accounts archived, links soft-deleted, firm archived); idempotent/resumable; per-account results returned.
• Admin token provisioned + stored as a k8s secret and consumed by economy-explorer in both dev and prod; revocable/rotatable.
• Controller→service→mapper layering; rate-limited; server-side audit per call.

Sibling: PAR-209 (economy-explorer UI + orchestration + explorer_audit).