feat: Phase 1c — Platform Admin Dashboard

Full super-admin dashboard for SaaS platform management:

Backend (10 files):
- Migration 003: Add is_super_admin column to users table
- JWT Claims: Carry is_super_admin through access tokens
- SuperAdmin extractor: Axum FromRequestParts that rejects non-admins (403)
- Admin API module: 10 endpoints behind /api/admin/*
  - GET /stats (KPIs: licenses, users, MRR, servers, signups)
  - GET/POST /licenses (paginated, filterable, manual generation)
  - GET/PATCH /licenses/:id (detail view, revoke/activate)
  - GET /subscriptions (module sub list with MRR breakdown)
  - GET/PATCH /users (paginated, toggle admin, disable accounts)
  - GET /servers (fleet overview across all licenses)
  - GET /health (DB pool, NATS status, table row counts)
- Bootstrap updated: first user gets is_super_admin = true

Frontend (8 files):
- 5 admin views in src/views/platform-admin/
- DashboardLayout: "Platform" nav section (gated on isSuperAdmin)
- Router: /admin/* routes with superAdmin meta guard
- Auth store: isSuperAdmin computed property
- Types: is_super_admin on User interface

Build: 80 chunks, zero TS errors, clean production build.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/src/db/users.rs

@@ -18,6 +18,7 @@ pub struct UserRow {
     #[serde(skip_serializing)]
     pub backup_codes: Option<Vec<String>>,
     pub email_verified: bool,
+    pub is_super_admin: bool,
     pub created_at: DateTime<Utc>,
     pub last_login_at: Option<DateTime<Utc>>,
 }
@@ -45,7 +46,7 @@ pub async fn create_user(
 pub async fn get_user_by_id(pool: &PgPool, user_id: Uuid) -> Result<Option<UserRow>> {
     let user = sqlx::query_as::<_, UserRow>(
         "SELECT id, email, username, password_hash, totp_secret, totp_enabled, \
-         backup_codes, email_verified, created_at, last_login_at \
+         backup_codes, email_verified, is_super_admin, created_at, last_login_at \
          FROM users WHERE id = $1",
     )
     .bind(user_id)
@@ -59,7 +60,7 @@ pub async fn get_user_by_id(pool: &PgPool, user_id: Uuid) -> Result<Option<UserR
 pub async fn get_user_by_email(pool: &PgPool, email: &str) -> Result<Option<UserRow>> {
     let user = sqlx::query_as::<_, UserRow>(
         "SELECT id, email, username, password_hash, totp_secret, totp_enabled, \
-         backup_codes, email_verified, created_at, last_login_at \
+         backup_codes, email_verified, is_super_admin, created_at, last_login_at \
          FROM users WHERE email = $1",
     )
     .bind(email)