feat(pitch-deck): passwordless investor auth, audit logs, snapshots & PWA (#2)

Adds investor-facing access controls, persistence, and PWA support to the pitch deck:

- Passwordless magic-link auth (jose JWT + nodemailer SMTP)
- Per-investor audit logging (logins, slide views, assumption changes, chat)
- Financial model snapshot persistence (auto-save/restore per investor)
- PWA support (manifest, service worker, offline caching, branded icons)
- Safeguards: email watermark overlay, security headers, content protection,
  rate limiting, IP/new-IP detection, single active session per investor
- Admin API: invite, list investors, revoke, query audit logs
- pitch-deck service added to docker-compose.coolify.yml

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pitch-deck/components/Watermark.tsx

@@ -0,0 +1,36 @@
+'use client'
+
+interface WatermarkProps {
+  text: string
+}
+
+export default function Watermark({ text }: WatermarkProps) {
+  if (!text) return null
+
+  return (
+    <div
+      className="fixed inset-0 pointer-events-none z-10 overflow-hidden select-none"
+      aria-hidden="true"
+    >
+      <div className="absolute inset-0 flex items-center justify-center">
+        <div
+          className="text-white/[0.03] text-2xl font-mono whitespace-nowrap tracking-widest"
+          style={{
+            transform: 'rotate(-35deg) scale(1.5)',
+            userSelect: 'none',
+            WebkitUserSelect: 'none',
+          }}
+        >
+          {/* Repeat the watermark text in a grid pattern */}
+          {Array.from({ length: 7 }, (_, row) => (
+            <div key={row} className="my-16">
+              {Array.from({ length: 3 }, (_, col) => (
+                <span key={col} className="mx-12">{text}</span>
+              ))}
+            </div>
+          ))}
+        </div>
+      </div>
+    </div>
+  )
+}