feat: introduce app-admin authorization and audit logging

- add migrations for owner/member workspace roles and application admins

- centralize /admin access checks with DB-backed admin resolution

- audit admin analytics/billing route access

- update account/admin UI typing and env/docs for ADMIN_EMAILS fallback behavior

src/components/AccountPage.tsx

@@ -54,6 +54,7 @@ export function AccountPage({ user, onUserUpdated, initialCheckoutPlanCode = nul
   const [adminWorkspaces, setAdminWorkspaces] = useState<BillingAdminWorkspaceSummary[]>([]);
   const [adminWorkspaceDetail, setAdminWorkspaceDetail] = useState<BillingAdminWorkspaceDetail | null>(null);
   const [adminLoading, setAdminLoading] = useState(false);
+  const isAdmin = account?.isAdmin ?? account?.isBillingAdmin ?? false;
 
   useEffect(() => {
     let isMounted = true;
@@ -75,7 +76,7 @@ export function AccountPage({ user, onUserUpdated, initialCheckoutPlanCode = nul
         setWorkspaceName(nextAccount.workspace.name);
         setNotice(getBillingReturnNotice());
 
-        if (nextAccount.isBillingAdmin) {
+        if ((nextAccount.isAdmin ?? nextAccount.isBillingAdmin ?? false)) {
           setAdminLoading(true);
           const adminResponse = await listAdminBillingWorkspaces();
           if (isMounted) {
@@ -633,7 +634,7 @@ export function AccountPage({ user, onUserUpdated, initialCheckoutPlanCode = nul
               <p className="mt-4 text-sm text-stone-600">{account.team.message}</p>
             </Card>
 
-            {account.isBillingAdmin ? (
+            {isAdmin ? (
               <Card className="p-6">
                 <div className="flex items-center justify-between gap-3">
                   <div>