feat(admin): add safe IAM archive round trips

[cxymds]

Summary

• add typed bounded rc admin iam export and rc admin iam import workflows for RustFS IAM archives
• emit deterministic versioned ZIPs with canonical JSON, 10 MiB compressed/expanded limits, and duplicate/unknown/ZIP-bomb rejection
• use atomic mode-0600 no-clobber exports and protected regular-file or stdin imports
• add mutation-free dry-run, explicit confirmation, fail/overwrite conflict policy, and destination preflight
• retry only safe export reads; report unknown mutation outcome after import transport loss without retrying or exposing server bodies

BREAKING contract update

The protected command and output references are extended with IAM archive commands and output-v3 records. Existing commands and schemas remain backward compatible.

Validation

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• focused IAM CLI/HTTP/help/output-schema tests
• git diff --check

Closes rustfs/backlog#1493
Refs rustfs/backlog#1380