B5: theme admin API, hosting chain hookup, session cookie root path

Admin endpoints under /panel/api/probe/* (list, preview, chunk
upload, repo install, update, select, delete, public settings).
saveThemeConfig gate aligned to hub: selectable, not disk-installed.
Session cookie Path=/ so the root public surface (theme config save,
/api/me authed) can see the operator session under a non-root panel
base path — with basePath-scoped cookies it was unreachable (401).

internal/web/controller/probe_public.go

@@ -328,7 +328,9 @@ func (pc *PublicProbeController) saveThemeConfig(c *gin.Context) {
 		return
 	}
 	short := c.Param("short")
-	if !service.ValidThemeShort(short) || !service.ProbeThemeInstalled(short) {
+	// Hub save_theme_config gates on selectable, not on a disk copy:
+	// the built-in theme's config is savable before any install.
+	if !service.ValidThemeShort(short) || !service.ProbeThemeSelectable(short) {
 		answerText(c, http.StatusBadRequest, "主题没有安装")
 		return
 	}