feat(pitch-deck): admin UI for investor + financial-model management (#3)

Adds /pitch-admin dashboard with real bcrypt admin accounts and full
audit attribution for every state-changing action.

- pitch_admins + pitch_admin_sessions tables (migration 002)
- pitch_audit_logs.admin_id + target_investor_id columns
- lib/admin-auth.ts: bcryptjs, single-session, jose JWT with audience claim
- middleware.ts: two-cookie gating with bearer-secret CLI fallback
- 14 new API routes (admin-auth, dashboard, investor detail/edit/resend,
  admins CRUD, fm scenarios + assumptions PATCH)
- 9 admin pages: login, dashboard, investors list/new/[id], audit,
  financial-model list/[id], admins
- Bootstrap CLI: npm run admin:create
- 36 vitest tests covering auth, admin-auth, rate-limit primitives

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pitch-deck/app/api/admin/invite/route.ts

@@ -1,22 +1,23 @@
 import { NextRequest, NextResponse } from 'next/server'
 import pool from '@/lib/db'
-import { validateAdminSecret, generateToken, logAudit, getClientIp } from '@/lib/auth'
+import { generateToken } from '@/lib/auth'
+import { requireAdmin, logAdminAudit } from '@/lib/admin-auth'
 import { sendMagicLinkEmail } from '@/lib/email'
 import { checkRateLimit, RATE_LIMITS } from '@/lib/rate-limit'
 
 export async function POST(request: NextRequest) {
-  if (!validateAdminSecret(request)) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
+  const guard = await requireAdmin(request)
+  if (guard.kind === 'response') return guard.response
+  const adminId = guard.kind === 'admin' ? guard.admin.id : null
 
-  const body = await request.json()
+  const body = await request.json().catch(() => ({}))
   const { email, name, company } = body
 
   if (!email || typeof email !== 'string') {
     return NextResponse.json({ error: 'Email required' }, { status: 400 })
   }
 
-  // Rate limit by email
+  // Rate limit by email (3/hour)
   const rl = checkRateLimit(`magic-link:${email.toLowerCase()}`, RATE_LIMITS.magicLink)
   if (!rl.allowed) {
     return NextResponse.json({ error: 'Too many invites for this email. Try again later.' }, { status: 429 })
@@ -34,7 +35,7 @@ export async function POST(request: NextRequest) {
        status = CASE WHEN pitch_investors.status = 'revoked' THEN 'invited' ELSE pitch_investors.status END,
        updated_at = NOW()
      RETURNING id, status`,
-    [normalizedEmail, name || null, company || null]
+    [normalizedEmail, name || null, company || null],
   )
 
   const investor = rows[0]
@@ -47,17 +48,21 @@ export async function POST(request: NextRequest) {
   await pool.query(
     `INSERT INTO pitch_magic_links (investor_id, token, expires_at)
      VALUES ($1, $2, $3)`,
-    [investor.id, token, expiresAt]
+    [investor.id, token, expiresAt],
   )
 
-  // Build magic link URL
   const baseUrl = process.env.PITCH_BASE_URL || 'https://pitch.breakpilot.ai'
   const magicLinkUrl = `${baseUrl}/auth/verify?token=${token}`
 
-  // Send email
   await sendMagicLinkEmail(normalizedEmail, name || null, magicLinkUrl)
 
-  await logAudit(investor.id, 'magic_link_sent', { email: normalizedEmail }, request)
+  await logAdminAudit(
+    adminId,
+    'investor_invited',
+    { email: normalizedEmail, name: name || null, company: company || null, expires_at: expiresAt.toISOString() },
+    request,
+    investor.id,
+  )
 
   return NextResponse.json({
     success: true,