feat: introduce app-admin authorization and audit logging

- add migrations for owner/member workspace roles and application admins

- centralize /admin access checks with DB-backed admin resolution

- audit admin analytics/billing route access

- update account/admin UI typing and env/docs for ADMIN_EMAILS fallback behavior

server/src/routes/account.ts

@@ -31,7 +31,7 @@ export const accountRoutes: FastifyPluginAsync = async (app) => {
         return reply.code(500).send({ error: 'Failed to load workspace.' });
       }
 
-      if (payload.workspaceName && workspace.role !== 'owner' && workspace.role !== 'admin') {
+      if (payload.workspaceName && workspace.role !== 'owner') {
         return reply.code(403).send({ error: 'You do not have permission to update this workspace.' });
       }