feat(pitch-deck): admin UI for investor + financial-model management (#3)

Adds /pitch-admin dashboard with real bcrypt admin accounts and full
audit attribution for every state-changing action.

- pitch_admins + pitch_admin_sessions tables (migration 002)
- pitch_audit_logs.admin_id + target_investor_id columns
- lib/admin-auth.ts: bcryptjs, single-session, jose JWT with audience claim
- middleware.ts: two-cookie gating with bearer-secret CLI fallback
- 14 new API routes (admin-auth, dashboard, investor detail/edit/resend,
  admins CRUD, fm scenarios + assumptions PATCH)
- 9 admin pages: login, dashboard, investors list/new/[id], audit,
  financial-model list/[id], admins
- Bootstrap CLI: npm run admin:create
- 36 vitest tests covering auth, admin-auth, rate-limit primitives

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pitch-deck/app/api/admin/revoke/route.ts

@@ -1,26 +1,32 @@
 import { NextRequest, NextResponse } from 'next/server'
 import pool from '@/lib/db'
-import { validateAdminSecret, revokeAllSessions, logAudit } from '@/lib/auth'
+import { revokeAllSessions } from '@/lib/auth'
+import { requireAdmin, logAdminAudit } from '@/lib/admin-auth'
 
 export async function POST(request: NextRequest) {
-  if (!validateAdminSecret(request)) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
+  const guard = await requireAdmin(request)
+  if (guard.kind === 'response') return guard.response
+  const adminId = guard.kind === 'admin' ? guard.admin.id : null
 
-  const body = await request.json()
+  const body = await request.json().catch(() => ({}))
   const { investor_id } = body
 
   if (!investor_id) {
     return NextResponse.json({ error: 'investor_id required' }, { status: 400 })
   }
 
-  await pool.query(
-    `UPDATE pitch_investors SET status = 'revoked', updated_at = NOW() WHERE id = $1`,
-    [investor_id]
+  const { rows } = await pool.query(
+    `UPDATE pitch_investors SET status = 'revoked', updated_at = NOW()
+     WHERE id = $1 RETURNING email`,
+    [investor_id],
   )
 
+  if (rows.length === 0) {
+    return NextResponse.json({ error: 'Investor not found' }, { status: 404 })
+  }
+
   await revokeAllSessions(investor_id)
-  await logAudit(investor_id, 'investor_revoked', {}, request)
+  await logAdminAudit(adminId, 'investor_revoked', { email: rows[0].email }, request, investor_id)
 
   return NextResponse.json({ success: true })
 }