#2438 serve: one unresolvable username in `auth.admins` stops the server from starting

Summary

If any name in auth.admins (or auth.allowed-users) can't be resolved on the OAuth provider, swamp serve exits at startup. One typo in an access list takes the whole server down.

Environment

• Seen in production on swamp 20260910 (core 375d7eca), --auth-mode oauth, provider https://swamp-club.com, @swamp/gcs-datastore@2026.09.23.1, @swamp/1password@2026.09.10.0
• Code path confirmed unchanged on main @ 1da85ec8
• Not reproduced in isolation: OAuth mode needs allowed-users/allowed-collectives and a swamp-club key with oauth:manage for headless client registration

Steps to reproduce

1. In serve.yaml:

   auth:
     mode: oauth
     oauth-provider: https://swamp-club.com
     admins: [alice, bob, alic_e]      # alic_e does not exist
     allowed-users: [alice, bob]

2. Start swamp serve.

Expected

An error is logged for alic_e and serve starts with the resolvable admins. Or the list is validated when the config is applied, before a restart.

Actual

Resolved admin "alice" to user:"…"
Resolved admin "bob" to user:"…"
Error: Failed to resolve admin 'alic_e': Username 'alic_e' not found on https://swamp-club.com. Ensure the username exists on https://swamp-club.com.

The process exits, and in Kubernetes it crash-loops (about 6 minutes of full downtime in our case).

Root cause (on main)

src/cli/commands/serve.ts ≈L2442 throws Failed to resolve admin '<name>': … during startup admin resolution instead of skipping or warning for that entry.

Suggested fix

Skip unresolvable admins and allowed users with an ERROR log, and serve with the rest. Optionally add a swamp serve --check-config (or similar) that validates the list up front.

Reproduction configuration

Test environment

serve.yaml:

host: 127.0.0.1
port: 19201
auth:
  mode: oauth
  oauth-provider: https://swamp-club.com
  admins: [alice, no-such-user-zz9]
  allowed-users: [alice]

Serve command:

swamp serve --repo-dir <repo> --host 127.0.0.1 --port 19201 --hot-reload --config serve.yaml