Admin: leases, pin, release, drain, usage, metrics

cmd/crossbar/main.go calls admin.Handler with the new 6-arg signature, passing nil for the not-yet-wired leases/limiter/store/drainer (task 07 wires them) so go vet and go test ./... pass on cmd/crossbar. This is a compile fix, not the task-07 wiring; noted in the implementer-log.

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

internal/lease/lease.go

@@ -194,6 +194,21 @@ func (t *Table) Acquire(k Key, candidates []string, now time.Time) (host string,
 	return host, false, nil
 }
 
+// Candidates records hosts as seen for route (idempotent), so Pin can accept a host the route
+// is configured for before any request has used it. cmd/crossbar calls it for every route at
+// start; the admin handler calls it before Pin.
+func (t *Table) Candidates(route string, hosts []string) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	if t.seen[route] == nil {
+		t.seen[route] = make(map[string]bool)
+	}
+	for _, h := range hosts {
+		t.seen[route][h] = true
+	}
+}
+
 // save writes a lease through, failing the call on a persister error.
 func (t *Table) save(l *Lease) error {
 	if err := t.p.SaveLease(l.store()); err != nil {