feat(marketplace): system-admin allow-list management UI

[LWS49]

Summary

Adds the System::Admin page for managing marketplace access rules. It lists the current typed rules, adds them through a two-step dialog that previews exactly who a rule would let in before it is saved, and carries an open-to-everyone / restrict toggle. The page is reachable from a new Marketplace Access entry in the admin navigator, and consumes the endpoints from the backend PR.

Design decisions

• The add-rule dialog previews before saving rather than reporting the effect afterwards - a domain rule can match hundreds of people, and an admin cannot judge a rule like @nus.edu.sg without seeing who it actually reaches.
• The preview lists blocked people first, then those who already have access, then the newly granted - the people a rule does not newly reach are the only reason to read the list at all, and alphabetical order buries them.
• The counts line names exclusions only when there are any - spelling out how many are new is noise in the common case where everyone is new.
• The instance picker is inlined in the rule form rather than lifted into lib/ - the only other instance picker in the codebase belongs to course duplication, and keeping this feature's UI self-contained means it can be reverted by deleting its own files.
• Opening the marketplace to everyone preserves the scoped rules instead of deleting them, so restricting again is a single toggle rather than a re-entry of every rule.

Regression prevention

Covers: lazy single-fetch of the instance list, the preview request and render for each rule type, the counts line with and without the blocked and already-has-access clauses, the blocked marker, an empty preview, rule table rendering and deletion, the mode banner and its confirmation dialogs, and the index page's fetch, create, delete and toggle flows including failure toasts.