Adds POST /admin/posts/feature, POST /admin/posts/unfeature (both auth-required, admin-checked inside controller via the use case's ForbiddenException), and public GET /posts/featured. Post serialization now includes featureSlot.