0.2.45: Administrator (view only) role

New external role administrator_viewer: signs into the admin interface
and reads everything for its granted funds and SPVs (overview, partners,
capital accounts with every investor's statements, documents, valuation
history) but every write is refused: no imports, uploads, deletions,
entity edits, exit marking, or account management. No migration needed;
roles are stored as strings.

Internal admins can flip an Administrator between full management and
view only via a new Access level dropdown in Users > Manage. The
user-list endpoint is read-widened for the viewer role so investor names
resolve on its screens; all mutating endpoints keep the stricter gate.

backend/ten31portal/auth.py

@@ -107,9 +107,10 @@ require_entity_writer = require_role(
 
 
 def require_internal_or_administrator(user: User = Depends(get_current_user)) -> User:
-    """Read gate for admin screens: any internal role, or the external Administrator.
+    """Read gate for admin screens: any internal role, or an external Administrator
+    (managing or view-only).
 
-    Investors are blocked; Administrator calls must still be scope-checked per entity.
+    Investors are blocked; external calls must still be scope-checked per entity.
     """
     if user.role == UserRole.investor:
         raise HTTPException(status_code=403, detail="Insufficient permissions")
@@ -117,9 +118,9 @@ def require_internal_or_administrator(user: User = Depends(get_current_user)) ->
 
 
 def check_administrator_scope(user: User, entity_id: int, session: Session) -> None:
-    """403 when an external Administrator touches an entity outside their grants.
+    """403 when an external account touches an entity outside their grants.
 
     Internal roles pass through untouched — their reach is decided by the route's gate.
     """
-    if user.role == UserRole.fund_administrator and not can_access_entity(user, entity_id, session):
+    if user.role in EXTERNAL_ROLES and not can_access_entity(user, entity_id, session):
         raise HTTPException(status_code=403, detail="No access to this entity")