feat(admin): Betreiber-Panel (/api/admin) mit is_admin-Flag

- 0003_admin.sql: accounts.is_admin
- auth.js: ensureAdminFlag (Konto = ADMIN_EMAIL wird auto-promoted),
  is_admin im JWT, requireAdmin-Middleware (prüft DB autoritativ)
- routes/admin.js: GET /stats (Kunden/Abos/Instanzen/MRR), GET /accounts,
  GET /accounts/:id/instances, POST /instances/:id/{suspend,reactivate}
- register/login + /account/me liefern is_admin
- ADMIN_EMAIL in .env.example

E2E: Admin-Promotion, Kunde→403, Stats (2 Kunden/MRR 49), Kundenliste.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/env.js

@@ -26,6 +26,8 @@ export const env = {
   publicBaseUrl: (e.PUBLIC_BASE_URL || "http://localhost:8787").replace(/\/+$/, ""),
   jwtSecret: e.JWT_SECRET || "dev-insecure-secret-change-me",
   databaseUrl: e.DATABASE_URL || "postgres://rapport_host:rapport_host@localhost:55432/rapport_host",
+  // Konto mit dieser E-Mail wird automatisch zum Admin (Betreiber-Bereich /admin).
+  adminEmail: (e.ADMIN_EMAIL || "").trim().toLowerCase(),
   // Gebautes public/ der RAPPORT-WEBSITE (Hugo). Default: Schwester-Repo lokal.
   websitePublicDir: e.WEBSITE_PUBLIC_DIR ||
     new URL("../../RAPPORT-WEBSITE/public", import.meta.url).pathname,