feat(nodes): add guarded worker commissioning and retirement

contracts/api/v2/fixtures/admin_node_capabilities_unavailable.json

@@ -0,0 +1,7 @@
+{
+  "revision": "c94aa508b5791bb321829684aa314520de10b17ac8658f8168de92a13bf9b781",
+  "state": "not_configured",
+  "allowed": false,
+  "worker_drain": false,
+  "disabled_creation": false
+}

contracts/api/v2/fixtures/admin_node_drain_requires_authentication.json

@@ -0,0 +1,7 @@
+{
+  "type": "https://siloserver.org/docs/api/v2/problems/authentication_required",
+  "title": "Authentication required",
+  "status": 401,
+  "detail": "Authentication is required.",
+  "instance": "urn:silo:request:0000000000000000000002e0"
+}

contracts/api/v2/fixtures/admin_node_drain_unavailable.json

@@ -0,0 +1,7 @@
+{
+  "type": "https://siloserver.org/docs/api/v2/problems/dependency_unavailable",
+  "title": "Dependency unavailable",
+  "status": 503,
+  "detail": "The worker drain service is not available on this server.",
+  "instance": "urn:silo:request:0000000000000000000002df"
+}

contracts/api/v2/fixtures/index.json

@@ -2338,6 +2338,64 @@
       "schema": "#/components/schemas/Problem",
       "body_file": "admin_network_access_unknown_host.json"
     },
+    {
+      "name": "admin_node_capabilities_unavailable",
+      "operation_id": "getAdminNodeCapabilities",
+      "scenario": "The administrator discovers unavailable drain and disabled commissioning services without guessing a build version.",
+      "request": {
+        "method": "GET",
+        "path": "/api/v2/admin/nodes/capabilities",
+        "headers": {
+          "Authorization": "Bearer tok-admin"
+        }
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Cache-Control": "private, no-cache",
+        "Content-Type": "application/json",
+        "ETag": "\"d35adbeff1618be39295a58c4631eeb22f37843f8fcd921108ab5bf25bb52c4f\""
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/AdminNodeDrainCapabilities",
+      "body_file": "admin_node_capabilities_unavailable.json"
+    },
+    {
+      "name": "admin_node_drain_requires_authentication",
+      "operation_id": "getAdminNodeDrain",
+      "scenario": "A worker retirement observation requires acting administrator authority.",
+      "request": {
+        "method": "GET",
+        "path": "/api/v2/admin/nodes/17/drain"
+      },
+      "expected_status": 401,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/problem+json"
+      },
+      "response_media_type": "application/problem+json",
+      "schema": "#/components/schemas/Problem",
+      "body_file": "admin_node_drain_requires_authentication.json"
+    },
+    {
+      "name": "admin_node_drain_unavailable",
+      "operation_id": "getAdminNodeDrain",
+      "scenario": "A missing drain service cannot return a retirement receipt.",
+      "request": {
+        "method": "GET",
+        "path": "/api/v2/admin/nodes/17/drain",
+        "headers": {
+          "Authorization": "Bearer tok-admin"
+        }
+      },
+      "expected_status": 503,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/problem+json"
+      },
+      "response_media_type": "application/problem+json",
+      "schema": "#/components/schemas/Problem",
+      "body_file": "admin_node_drain_unavailable.json"
+    },
     {
       "name": "admin_password_reset_email",
       "operation_id": "createAdminUserPasswordReset",