Re-activate Data Custodian admin portal dashboard (broken links + unreadable navbar)

[dfcoffin]

Summary

The Data Custodian must retain a customer/admin portal alongside its ESPI resource-server role. After the "UI not needed in resource server" decommissioning, the custodian dashboard (/DataCustodian/custodian/home) renders but every action card 404s, and the top menu bar is unreadable. This issue re-activates the admin portal capabilities and fixes the navbar contrast.

Defects

1. Dashboard action links 404 (context-path bug)

templates/custodian/home.html and the custodianHeader nav fragment hard-code absolute links (href="/custodian/..."). The app is served under context-path /DataCustodian, so the browser requests http://localhost:8081/custodian/... → 404. Links must be context-relative Thymeleaf links (th:href="@{/custodian/...}").

2. Backing controllers/templates missing or disabled

Link	State
/custodian/retailcustomers	RetailCustomerController enabled, but its index/form/show templates do not exist (and view names are inconsistent)
/custodian/upload	UploadController @Controller commented out, no template
/custodian/oauth/tokens	no controller, no template
/custodian/settings	no controller, no template

3. Navbar unreadable (WCAG contrast failure)

fragments/layout.html :: custodianHeader uses navbar-dark bg-warning — light/white link text on a light amber (#FF9800) background. Fails contrast and is unreadable. Fix to dark text on amber (data-bs-theme="light").

Scope (full restore)

• Fix all custodian nav + dashboard links to context-relative th:href.
• Fix custodianHeader contrast to readable dark-on-amber.
• Map bare /custodian → dashboard; populate dashboard stat tiles from services.
• Normalize RetailCustomerController view names; add index/form/show templates.
• Re-enable UploadController (@Controller + ROLE_CUSTODIAN) + add upload template.
• Add OAuthTokenController + read-only tokens table (over AuthorizationService).
• Add SettingsController + read-only system-info page (no writes — CRUD stays deferred per chore(#119): defer ESPI resource CRUD writes — delete write/admin controllers #166).
• All admin pages gated @PreAuthorize("hasRole('ROLE_CUSTODIAN')") on the existing form-login chain.

Acceptance

• Logged in as a ROLE_CUSTODIAN admin, every dashboard card and nav item resolves (HTTP 200), no 404s.
• Top menu bar text is readable on every portal page.
• mvn -pl openespi-datacustodian -am test green; CI green.