fix(V2): hoist _IBKRRotateConfirmReq to module level

Defining the Pydantic body model inside make_admin_router() leaves an
unresolved forward reference under `from __future__ import annotations`,
which breaks /openapi.json generation with PydanticUserError.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/cerbero_mcp/admin.py

@@ -16,6 +16,12 @@ MAX_RECORDS = 10000
 DEFAULT_LIMIT = 1000
 
 
+class _IBKRRotateConfirmReq(BaseModel):
+    new_consumer_key: str
+    new_access_token: str
+    new_access_token_secret: str
+
+
 def _parse_iso(value: str | None) -> datetime | None:
     if not value:
         return None
@@ -158,11 +164,6 @@ def make_admin_router() -> APIRouter:
             },
         }
 
-    class _IBKRRotateConfirmReq(BaseModel):
-        new_consumer_key: str
-        new_access_token: str
-        new_access_token_secret: str
-
     @r.post("/ibkr/rotate-keys/start")
     async def _ibkr_rotate_start(env: str, request: Request):
         if env not in ("testnet", "mainnet"):