feat(admin): Betreiber-Panel (/api/admin) mit is_admin-Flag

- 0003_admin.sql: accounts.is_admin
- auth.js: ensureAdminFlag (Konto = ADMIN_EMAIL wird auto-promoted),
  is_admin im JWT, requireAdmin-Middleware (prüft DB autoritativ)
- routes/admin.js: GET /stats (Kunden/Abos/Instanzen/MRR), GET /accounts,
  GET /accounts/:id/instances, POST /instances/:id/{suspend,reactivate}
- register/login + /account/me liefern is_admin
- ADMIN_EMAIL in .env.example

E2E: Admin-Promotion, Kunde→403, Stats (2 Kunden/MRR 49), Kundenliste.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/routes/auth.js

@@ -1,7 +1,7 @@
 // HOST-Konten: Registrierung + Login. Gibt ein JWT zurück.
 import { Router } from "express";
 import { one } from "../db.js";
-import { hashPassword, verifyPassword, signToken } from "../auth.js";
+import { hashPassword, verifyPassword, signToken, ensureAdminFlag } from "../auth.js";
 
 export const authRouter = Router();