rule(B-0743)+backlog: desktop admin consent pattern via biometric + small challenge ('I execute, you fingerprint') — new consent-first AI design pattern for admin permission on desktop instead of server - #5006