fix: add admin API readiness probe

[miki3421]

Summary

• add a TCP readiness probe on the named admin-api port
• keep the Service endpoint unavailable until the Waitress listener is accepting connections
• make StatefulSet rollout status reflect actual application readiness

Validation

• rendered manifest accepted by kubectl apply --dry-run=client
• live Kind rollout completed with the probe
• SSO password test completed successfully against the updated admin-api image