B5: theme admin API, hosting chain hookup, session cookie root path

Admin endpoints under /panel/api/probe/* (list, preview, chunk
upload, repo install, update, select, delete, public settings).
saveThemeConfig gate aligned to hub: selectable, not disk-installed.
Session cookie Path=/ so the root public surface (theme config save,
/api/me authed) can see the operator session under a non-root panel
base path — with basePath-scoped cookies it was unreachable (401).

internal/web/controller/api.go

@@ -202,6 +202,10 @@ func (a *APIController) initRouter(g *gin.RouterGroup) {
 	// (/panel/api/agent/probe-tasks*).
 	NewProbeTasksController(agentAdmin)
 
+	// Item 7 B5: theme store + public-surface settings, on the API
+	// group itself (/panel/api/probe/*).
+	NewProbeThemesController(api)
+
 	// Hosts API — per-inbound override endpoints for subscription links
 	hosts := api.Group("/hosts")
 	a.hostController = NewHostController(hosts)