refactor(admin): separates Admin-Login statt is_admin-Flag

Auf Wunsch: Betreiber-Bereich getrennt von Kundenkonten.
- auth.js: signAdminToken (role:operator), requireAdmin prüft Token-Rolle;
  requireAuth weist Operator-Token ab (saubere Trennung beide Richtungen)
- routes/admin.js: POST /admin/login (ADMIN_PASSWORD → Operator-Token)
- env.js: adminPassword statt adminEmail
- 0003_admin.sql: droppt die nicht mehr genutzte accounts.is_admin-Spalte
- register/login/account/me: is_admin restlos entfernt

E2E: Kunde→403, falsches PW→401, richtiges PW→Token, stats→200,
Admin-Token→Kundenroute→401.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/routes/account.js

@@ -12,7 +12,7 @@ const PROFILE_FIELDS = ["company", "contact_name", "street", "zip", "city", "cou
 // ── Konto-Übersicht: Konto + Profil + aktuelles Abo + alle Instanzen ─────────
 accountRouter.get("/me", requireAuth, async (req, res) => {
   const account = await one(
-    `select id, email, company, contact_name, street, zip, city, country, phone, is_admin, created_at
+    `select id, email, company, contact_name, street, zip, city, country, phone, created_at
        from accounts where id = $1`,
     [req.account.id]
   );