feat(pitch-deck): admin UI for investor + financial-model management

Adds /pitch-admin dashboard with real admin accounts (bcrypt) and full
audit attribution for every state-changing action.

Backend:
- pitch_admins + pitch_admin_sessions tables (migration 002)
- pitch_audit_logs.admin_id + target_investor_id columns
- lib/admin-auth.ts: bcryptjs hashing, single-session enforcement,
  jose JWT with 'pitch-admin' audience claim, requireAdmin guard
- logAudit extended to accept admin_id and target_investor_id
- middleware.ts: gates /pitch-admin/* and /api/admin/* on the admin
  cookie (with bearer-secret fallback for CLI compatibility)
- 14 API routes under /api/admin-auth and /api/admin (login, logout,
  me, dashboard, investors[id] CRUD + resend, admins CRUD,
  fm scenarios + assumptions PATCH)
- Existing /api/admin/{invite,investors,revoke,audit-logs} migrated
  to requireAdmin and now log with admin_id + target_investor_id
- scripts/create-admin.ts CLI bootstrap (npm run admin:create)

Frontend:
- /pitch-admin/login + /pitch-admin/(authed) route group
- AdminShell with sidebar nav + StatCard + AuditLogTable components
- Dashboard with KPIs, recent logins, recent activity
- Investors list with search/filter + resend/revoke inline actions
- Investor detail with inline edit + per-investor audit timeline
- Audit log viewer with actor/action/date filters + pagination
- Financial model scenario list + per-scenario assumption editor
  (categorized, inline edit, before/after diff in audit)
- Admins management (add, deactivate, reset password)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pitch-deck/lib/auth.ts

@@ -148,13 +148,16 @@ export async function logAudit(
   details: Record<string, unknown> = {},
   request?: Request,
   slideId?: string,
-  sessionId?: string
+  sessionId?: string,
+  adminId?: string | null,
+  targetInvestorId?: string | null,
 ): Promise<void> {
   const ip = request ? getClientIp(request) : null
   const ua = request ? request.headers.get('user-agent') : null
   await pool.query(
-    `INSERT INTO pitch_audit_logs (investor_id, action, details, ip_address, user_agent, slide_id, session_id)
-     VALUES ($1, $2, $3, $4, $5, $6, $7)`,
-    [investorId, action, JSON.stringify(details), ip, ua, slideId, sessionId]
+    `INSERT INTO pitch_audit_logs
+       (investor_id, action, details, ip_address, user_agent, slide_id, session_id, admin_id, target_investor_id)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
+    [investorId, action, JSON.stringify(details), ip, ua, slideId, sessionId, adminId ?? null, targetInvestorId ?? null]
   )
 }