fix: model load/unload 401 (front auth probe); township refs honor run-page res/steps

1. Model load/unload (and every is_admin-gated front action) returned 401: is_admin
   probed prim.url + /admin/api/status on the engine, but that route is front-only
   (removed from the engine in def78c18), so it 404'd → never 200 → Unauthorized. Add
   an engine-side admin-gated /admin/api/whoami and point is_admin at it.

2. Township reference generation (characters/environments pages — _run_regen_job and
   _run_create_profile_job) hardcoded 768x512/512x512 + 28 steps, ignoring the Run
   page. Add _ref_gen_res_steps(args) (honors keyframe_size/keyframe_steps, re-read
   from the saved config so edits apply without restart) and use it at the reference
   generators; generate_character/generate_environment now forward `steps` (the
   server already accepts it). Keyframes/match videos already honored the config.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RdMufYvtTbtGDWsiZVoXce