fix(admin): implement mountEarly() so plugin-registered routes see adminContext/auth

[zumbrunn]

Problem

A third-party plugin's own mount()-registered route could never see ctx.state.adminContext or ctx.state.auth, no matter how the request was authenticated — withGuards() always treated it as unauthenticated.

Root cause

This plugin's own mount() always runs last (bootstrap() in @dune/core can't construct it until authz, the HMAC key, and the history engine are ready — well after every site-configured plugin already registered). Fresh 2 snapshots each route's middleware chain at the moment the route is registered, so any other plugin's own route was compiled before this plugin's ctx.state.adminContext = … and admin-auth middleware existed at all.

Fix

Implements the new DunePlugin.mountEarly() hook from duneorg/dune#17: mountDuneAdminEarly() registers just the two pieces of middleware other plugins' routes depend on — ctx.state.adminContext and the admin auth middleware (ctx.state.auth) — before any plugin's mount() runs.

The AdminContext object itself is still built inside mount(), unchanged — restructuring where it's built was out of scope and too risky for this fix. mountEarly()'s middleware reads it through a lazily-resolved getter closure that starts returning the real value once mount() finishes building it, well before the app can actually serve a request. Both new middleware registrations are guarded against double-registration (WeakSet, mirrors the existing registerPluginPublicRoutes() pattern in @dune/core) so headless-mode direct callers of mountDuneAdmin() — who never call mountEarly() — are unaffected.

Also discovered

A plugin's own guarded route must be registered under the admin path prefix (e.g. /admin/my-plugin/…) — the admin auth middleware that sets ctx.state.auth only runs for requests under that prefix, same as every built-in admin route. Documented in admin/guards.ts's example and in duneorg/dune-docs#4.

Requires

• @dune/core@^0.34.4 (fix(plugins): add mountEarly() so third-party plugins can use admin-guarded routes dune#17) — bumped in this PR's deno.json.

Testing

• New regression test tests/admin/mount_early_test.ts — verified it fails (both sawAdminContext/sawAuth false, and a TS2724 against pre-fix mount.ts for the missing export) without the fix, passes with it.
• Full suite: deno test -A — 233 passed, 0 failed.
• deno lint src/ and deno check clean.

🤖 Generated with Claude Code