What

The WebSocket layer is now protocol-only; admin CRUD, config, import, export, and radioreference business logic live in a new transport-agnostic internal/admin package.

• New internal/admin/ package (62 Operations methods across 18 files: users.go, systems.go, talkgroups.go, tags.go, groups.go, units.go, api_keys.go, dirmonitors.go, downstreams.go, webhooks.go, shared_links.go, settings.go, transcription.go, radioreference.go, filesystem.go, imports.go, exports.go, operations.go). No imports of internal/ws or net/http.
• internal/admin/operations.go defines an EventSink interface (BroadcastAdminEvent, BroadcastCFG, DisconnectByUser, ClientCount). ws.Hub implements it; admin.New takes it at construction.
• internal/ws/admin_router.go replaces admin_ops.go as the thin transport adapter. The adminOpHandlers map preserves every wire op (users.list, systems.create, config.update, export.config, etc.) byte-identically.
• Live-state ops (activity.stats, activity.chart, activity.top-talkgroups, logs.query, logs.level) stay on *Client — they read hub in-memory state that the admin package doesn't have.
• internal/ws/admin_ops.go deleted (3,201 lines).
• ws.HubDeps is now a type alias for admin.Deps. Hub construction signature at the call site is unchanged: ws.NewHub(queries, version, ws.HubDeps{...}) still works.
• main.go updated: SensitiveSettingKeys moved from ws to admin.

Tests

admin_ops_settings_test.go was split:

• CRUD semantics → internal/admin/settings_test.go
• Dispatch / error envelope → internal/ws/admin_router_test.go (new)

Wire-protocol guarantee

Every ADM_REQ / ADM_RES frame, action name, error envelope, and payload key is byte-identical to pre-PR. The frontend sees no change. There is an explicit test in admin_router_test.go that enumerates the expected wire ops and asserts the router exposes exactly that set (no additions, no missing).

Blast radius

• No route changes
• No schema changes
• No auth surface changes
• No wire-protocol changes
• internal/admin is a net-new package with no external consumers outside internal/ws and cmd/server

Diff

Net +428 LOC (3,724 added, 3,296 removed — mostly a move out of the 3,201-line admin_ops.go).

Verification

• go build ./... && go vet ./... — green
• go test ./internal/ws/... ./internal/admin/... ./internal/api/... — all three packages pass
• go test ./... — full suite green

Changelog

[Unreleased] bullet added under ### Changed.