Admin: mentorship + sponsorship oversight endpoints (Phase 8.4, 8.5)

[pablo-clueless]

Scope

Read-heavy admin surfaces for the dashboard, plus one intervention action.

Mentorship oversight

Method	Path	Notes
GET	/admin/mentorship/pairs	active pairs, paginated
GET	/admin/mentorship/sessions?upcoming=true	upcoming sessions
GET	/admin/mentorship/mentors	capacity overview (capacity vs active count)
POST	/admin/mentorship/{id}/conclude	conclude-on-behalf for disputes (audit-logged via Serilog structured fields)

Sponsorship oversight

Method	Path	Notes
GET	/admin/sponsors	list with status, tier, subscription state
GET	/admin/sponsors/summary	MRR computed from active subscriptions (annual normalized to monthly) + counts by status
GET	/admin/sponsors/{id}/invoices	mirrored invoices with status + Stripe hosted links

Rules

• Endpoints live in the owning modules under /admin/* with the admin policy at group level (Admin: policy-based authorization + member management endpoints (Phase 8.1, 8.2, 2.6) #1's pattern) — the Admin module itself owns nothing here.
• All list endpoints paginated; summaries are single cheap queries.

Error codes

admin.forbidden, mentorship.not_found, sponsorship.not_found

Dependencies

Blocked by #1; mentorship endpoints need #10/#11; sponsorship endpoints need #16.

Acceptance criteria

• MRR math tested: monthly + annual mix, PastDue excluded
• Conclude-on-behalf emits the same events/side-effects as participant conclusion
• Non-admin blocked on every endpoint

Conventions (project-wide, non-negotiable)

• .NET 9, records for immutable shapes, file-scoped namespaces, primary constructors where they read well. Minimal-API endpoints grouped per module via IEndpointModule.MapEndpoints.
• Result<T> (SharedKernel) instead of exception-driven control flow. Endpoint results map failures to ProblemDetails with the stable error codes listed above — the frontend keys off them.
• Module owns its EF Core DbContext mapped to its own Postgres schema. Modules never reference each other's internals — cross-module needs go through a public contract interface or an in-process domain event (IEventPublisher).
• All external calls (GitHub, Stripe, Brevo, Cloudinary, Meilisearch) behind interfaces owned by the consuming module.
• Every list endpoint paginated (offset is fine). xUnit tests in tests/CommunityPro.Tests/<Module>/ following the existing harness patterns (see Members/MembersTestHarness.cs).