feat(pitch-deck): admin UI for investor + financial-model management

Adds /pitch-admin dashboard with real admin accounts (bcrypt) and full
audit attribution for every state-changing action.

Backend:
- pitch_admins + pitch_admin_sessions tables (migration 002)
- pitch_audit_logs.admin_id + target_investor_id columns
- lib/admin-auth.ts: bcryptjs hashing, single-session enforcement,
  jose JWT with 'pitch-admin' audience claim, requireAdmin guard
- logAudit extended to accept admin_id and target_investor_id
- middleware.ts: gates /pitch-admin/* and /api/admin/* on the admin
  cookie (with bearer-secret fallback for CLI compatibility)
- 14 API routes under /api/admin-auth and /api/admin (login, logout,
  me, dashboard, investors[id] CRUD + resend, admins CRUD,
  fm scenarios + assumptions PATCH)
- Existing /api/admin/{invite,investors,revoke,audit-logs} migrated
  to requireAdmin and now log with admin_id + target_investor_id
- scripts/create-admin.ts CLI bootstrap (npm run admin:create)

Frontend:
- /pitch-admin/login + /pitch-admin/(authed) route group
- AdminShell with sidebar nav + StatCard + AuditLogTable components
- Dashboard with KPIs, recent logins, recent activity
- Investors list with search/filter + resend/revoke inline actions
- Investor detail with inline edit + per-investor audit timeline
- Audit log viewer with actor/action/date filters + pagination
- Financial model scenario list + per-scenario assumption editor
  (categorized, inline edit, before/after diff in audit)
- Admins management (add, deactivate, reset password)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pitch-deck/app/pitch-admin/(authed)/financial-model/[scenarioId]/page.tsx

@@ -0,0 +1,184 @@
+'use client'
+
+import { useEffect, useState } from 'react'
+import { useParams } from 'next/navigation'
+import Link from 'next/link'
+import { ArrowLeft, Save } from 'lucide-react'
+
+interface Assumption {
+  id: string
+  scenario_id: string
+  key: string
+  label_de: string
+  label_en: string
+  value: number | number[]
+  value_type: 'scalar' | 'step' | 'timeseries'
+  unit: string
+  min_value: number | null
+  max_value: number | null
+  step_size: number | null
+  category: string
+  sort_order: number
+}
+
+interface Scenario {
+  id: string
+  name: string
+  description: string
+  is_default: boolean
+  color: string
+  assumptions: Assumption[]
+}
+
+export default function EditScenarioPage() {
+  const { scenarioId } = useParams<{ scenarioId: string }>()
+  const [scenario, setScenario] = useState<Scenario | null>(null)
+  const [loading, setLoading] = useState(true)
+  const [edits, setEdits] = useState<Record<string, string>>({})
+  const [savingId, setSavingId] = useState<string | null>(null)
+  const [toast, setToast] = useState<string | null>(null)
+
+  function flashToast(msg: string) {
+    setToast(msg)
+    setTimeout(() => setToast(null), 3000)
+  }
+
+  async function load() {
+    setLoading(true)
+    const res = await fetch('/api/admin/fm/scenarios')
+    if (res.ok) {
+      const d = await res.json()
+      const found = (d.scenarios as Scenario[]).find(s => s.id === scenarioId)
+      setScenario(found || null)
+    }
+    setLoading(false)
+  }
+
+  useEffect(() => { if (scenarioId) load() }, [scenarioId])
+
+  function setEdit(id: string, val: string) {
+    setEdits(prev => ({ ...prev, [id]: val }))
+  }
+
+  async function saveAssumption(a: Assumption) {
+    const raw = edits[a.id]
+    if (raw === undefined) return
+    let parsed: number | number[]
+    try {
+      parsed = a.value_type === 'timeseries' ? JSON.parse(raw) : Number(raw)
+      if (a.value_type !== 'timeseries' && !Number.isFinite(parsed)) throw new Error('not a number')
+    } catch {
+      flashToast('Invalid value')
+      return
+    }
+
+    setSavingId(a.id)
+    const res = await fetch(`/api/admin/fm/assumptions/${a.id}`, {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ value: parsed }),
+    })
+    setSavingId(null)
+    if (res.ok) {
+      flashToast('Saved')
+      setEdits(prev => {
+        const next = { ...prev }
+        delete next[a.id]
+        return next
+      })
+      load()
+    } else {
+      flashToast('Save failed')
+    }
+  }
+
+  if (loading) return <div className="flex items-center justify-center h-64"><div className="w-8 h-8 border-2 border-indigo-500 border-t-transparent rounded-full animate-spin" /></div>
+  if (!scenario) return <div className="text-rose-400">Scenario not found</div>
+
+  // Group by category
+  const byCategory: Record<string, Assumption[]> = {}
+  scenario.assumptions.forEach(a => {
+    if (!byCategory[a.category]) byCategory[a.category] = []
+    byCategory[a.category].push(a)
+  })
+
+  return (
+    <div className="space-y-6">
+      <Link href="/pitch-admin/financial-model" className="inline-flex items-center gap-2 text-sm text-white/50 hover:text-white/80">
+        <ArrowLeft className="w-4 h-4" /> Back to scenarios
+      </Link>
+
+      <div>
+        <div className="flex items-center gap-3 mb-1">
+          <div className="w-4 h-4 rounded-full" style={{ backgroundColor: scenario.color }} />
+          <h1 className="text-2xl font-semibold text-white">{scenario.name}</h1>
+          {scenario.is_default && (
+            <span className="text-[9px] px-1.5 py-0.5 rounded bg-indigo-500/20 text-indigo-300 uppercase font-semibold">
+              Default
+            </span>
+          )}
+        </div>
+        {scenario.description && <p className="text-sm text-white/50">{scenario.description}</p>}
+      </div>
+
+      <div className="space-y-6">
+        {Object.entries(byCategory).map(([cat, items]) => (
+          <section key={cat} className="bg-white/[0.04] border border-white/[0.06] rounded-2xl p-5">
+            <h2 className="text-xs font-semibold uppercase tracking-wider text-white/50 mb-4">{cat}</h2>
+            <div className="space-y-3">
+              {items.map(a => {
+                const isEdited = edits[a.id] !== undefined
+                const currentValue = isEdited
+                  ? edits[a.id]
+                  : a.value_type === 'timeseries'
+                    ? JSON.stringify(a.value)
+                    : String(a.value)
+
+                return (
+                  <div key={a.id} className="grid grid-cols-12 gap-3 items-center">
+                    <div className="col-span-5 min-w-0">
+                      <div className="text-sm text-white/90 truncate">{a.label_en || a.label_de}</div>
+                      <div className="text-xs text-white/40 font-mono truncate">{a.key}</div>
+                    </div>
+                    <div className="col-span-4 flex items-center gap-2">
+                      <input
+                        type="text"
+                        value={currentValue}
+                        onChange={e => setEdit(a.id, e.target.value)}
+                        className={`flex-1 bg-black/30 border rounded-lg px-3 py-1.5 text-sm text-white font-mono focus:outline-none focus:ring-2 focus:ring-indigo-500/40 ${
+                          isEdited ? 'border-amber-500/50' : 'border-white/10'
+                        }`}
+                      />
+                      {a.unit && <span className="text-xs text-white/40">{a.unit}</span>}
+                    </div>
+                    <div className="col-span-2 text-xs text-white/30 font-mono">
+                      {a.min_value !== null && a.max_value !== null ? `${a.min_value}–${a.max_value}` : ''}
+                    </div>
+                    <div className="col-span-1 flex justify-end">
+                      {isEdited && (
+                        <button
+                          onClick={() => saveAssumption(a)}
+                          disabled={savingId === a.id}
+                          className="bg-indigo-500 hover:bg-indigo-600 text-white p-1.5 rounded-lg disabled:opacity-50"
+                          title="Save"
+                        >
+                          <Save className="w-3.5 h-3.5" />
+                        </button>
+                      )}
+                    </div>
+                  </div>
+                )
+              })}
+            </div>
+          </section>
+        ))}
+      </div>
+
+      {toast && (
+        <div className="fixed bottom-6 right-6 bg-indigo-500/20 border border-indigo-500/40 text-indigo-200 text-sm px-4 py-2 rounded-lg backdrop-blur-sm">
+          {toast}
+        </div>
+      )}
+    </div>
+  )
+}

pitch-deck/app/pitch-admin/(authed)/financial-model/page.tsx

@@ -0,0 +1,73 @@
+'use client'
+
+import { useEffect, useState } from 'react'
+import Link from 'next/link'
+import { ArrowRight } from 'lucide-react'
+
+interface Scenario {
+  id: string
+  name: string
+  description: string
+  is_default: boolean
+  color: string
+  assumptions: Array<{ id: string; key: string }>
+}
+
+export default function FinancialModelPage() {
+  const [scenarios, setScenarios] = useState<Scenario[]>([])
+  const [loading, setLoading] = useState(true)
+
+  useEffect(() => {
+    fetch('/api/admin/fm/scenarios')
+      .then(r => r.json())
+      .then(d => setScenarios(d.scenarios || []))
+      .finally(() => setLoading(false))
+  }, [])
+
+  if (loading) {
+    return <div className="flex items-center justify-center h-64"><div className="w-8 h-8 border-2 border-indigo-500 border-t-transparent rounded-full animate-spin" /></div>
+  }
+
+  return (
+    <div className="space-y-6">
+      <div>
+        <h1 className="text-2xl font-semibold text-white">Financial Model</h1>
+        <p className="text-sm text-white/50 mt-1">
+          Edit default scenarios and assumptions. Investor snapshots are not affected.
+        </p>
+      </div>
+
+      <div className="grid md:grid-cols-2 gap-4">
+        {scenarios.map(s => (
+          <Link
+            key={s.id}
+            href={`/pitch-admin/financial-model/${s.id}`}
+            className="bg-white/[0.04] border border-white/[0.06] hover:border-white/[0.15] rounded-2xl p-5 transition-colors block"
+          >
+            <div className="flex items-start justify-between gap-3 mb-3">
+              <div className="min-w-0">
+                <div className="flex items-center gap-2 mb-1">
+                  <div
+                    className="w-3 h-3 rounded-full"
+                    style={{ backgroundColor: s.color }}
+                  />
+                  <h3 className="text-base font-semibold text-white">{s.name}</h3>
+                  {s.is_default && (
+                    <span className="text-[9px] px-1.5 py-0.5 rounded bg-indigo-500/20 text-indigo-300 uppercase font-semibold">
+                      Default
+                    </span>
+                  )}
+                </div>
+                {s.description && <p className="text-sm text-white/50">{s.description}</p>}
+              </div>
+              <ArrowRight className="w-4 h-4 text-white/30 mt-1 shrink-0" />
+            </div>
+            <div className="text-xs text-white/40">
+              {s.assumptions.length} assumption{s.assumptions.length === 1 ? '' : 's'}
+            </div>
+          </Link>
+        ))}
+      </div>
+    </div>
+  )
+}