feat: Phase 1c — Platform Admin Dashboard

Full super-admin dashboard for SaaS platform management:

Backend (10 files):
- Migration 003: Add is_super_admin column to users table
- JWT Claims: Carry is_super_admin through access tokens
- SuperAdmin extractor: Axum FromRequestParts that rejects non-admins (403)
- Admin API module: 10 endpoints behind /api/admin/*
  - GET /stats (KPIs: licenses, users, MRR, servers, signups)
  - GET/POST /licenses (paginated, filterable, manual generation)
  - GET/PATCH /licenses/:id (detail view, revoke/activate)
  - GET /subscriptions (module sub list with MRR breakdown)
  - GET/PATCH /users (paginated, toggle admin, disable accounts)
  - GET /servers (fleet overview across all licenses)
  - GET /health (DB pool, NATS status, table row counts)
- Bootstrap updated: first user gets is_super_admin = true

Frontend (8 files):
- 5 admin views in src/views/platform-admin/
- DashboardLayout: "Platform" nav section (gated on isSuperAdmin)
- Router: /admin/* routes with superAdmin meta guard
- Auth store: isSuperAdmin computed property
- Types: is_super_admin on User interface

Build: 80 chunks, zero TS errors, clean production build.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/views/platform-admin/AdminLicenses.vue

@@ -34,13 +34,6 @@ interface LicenseDetail {
   } | null
 }
 
-interface LicenseListResponse {
-  licenses: License[]
-  total: number
-  page: number
-  per_page: number
-}
-
 const licenses = ref<License[]>([])
 const isLoading = ref(false)
 const searchQuery = ref('')
@@ -92,8 +85,8 @@ async function fetchLicenses() {
     if (searchQuery.value.trim()) params.set('search', searchQuery.value.trim())
     if (statusFilter.value !== 'all') params.set('status', statusFilter.value)
 
-    const data = await api.get<LicenseListResponse>(`/admin/licenses?${params}`)
-    licenses.value = data.licenses
+    const data = await api.get<{ data: License[]; total: number }>(`/admin/licenses?${params}`)
+    licenses.value = data.data
     total.value = data.total
   } catch {
     // API not wired yet