leaderboard: admin rescore (selected + all) reusing the eval pipeline

leaderboard: serve renders from the public bucket, not the dataset proxy

admin: stop pending jobs before delete

admin: bulk promote/demote/delete + admin table loader

tests: cover the admin gate and promote/demote helpers