Adds listTransactions controller action and its Swig view, and creates
app/routes/admin.server.routes.js to finally wire every admin controller
function (Tasks 7-9) to real HTTP routes via the app's glob-based route
loader. basicAuth protects /admin/transactions and /admin/transactions/new;
the pay page, epay return, and epay IPN endpoints stay public.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>