Add protected read-only installation inventory for internal admin

[neonwatty]

Summary

• Add a server-to-server, read-only paginated inventory of legacy installations and nullable best-effort successful-feedback counts.
• Require a dedicated bearer credential before any KV or Durable Object read; return no-store responses and no browser CORS access.
• Check identity and deletion guards, keep cursors out of URL logs, and fail closed on malformed records or unavailable storage.
• Preserve the historical public-plane fingerprint as V1 and add an explicitly reviewed V2 baseline for this intentional public Worker change.

Verification

• Independent read-only review found no confirmed blocking code defect.
• npm test: 2,525 passing tests across 151 files.
• npm run typecheck, npm run lint, targeted Prettier check, npm run verify:legacy-compat, and git diff checks passed.
• Adversarial tests cover auth-before-storage, missing versus zero counts, opaque pagination, deletion between list and read, empty continuation pages, Durable Object failures, and cursor logging.

Rollout gates

• Informational best-effort counts only: no measured freshness age or guaranteed immediate disappearance after uninstall; not a billing meter or authoritative active-installation registry.
• No deployment or secret provisioning is included. Provision a high-entropy dedicated secret on both servers only after review, with a rotation plan.
• Qualify a nonproduction smoke path first. Preview currently has installation usage collection disabled, so the inventory route returns unavailable there.
• The bugdrop.dev staff sign-in, role checks, access audit, and dashboard are separate follow-up work before administrator use.