0.2.45: Administrator (view only) role

New external role administrator_viewer: signs into the admin interface
and reads everything for its granted funds and SPVs (overview, partners,
capital accounts with every investor's statements, documents, valuation
history) but every write is refused: no imports, uploads, deletions,
entity edits, exit marking, or account management. No migration needed;
roles are stored as strings.

Internal admins can flip an Administrator between full management and
view only via a new Access level dropdown in Users > Manage. The
user-list endpoint is read-widened for the viewer role so investor names
resolve on its screens; all mutating endpoints keep the stricter gate.

backend/ten31portal/models.py

@@ -20,11 +20,12 @@ class UserRole(str, enum.Enum):
     viewer = "viewer"
     # External accounts (entity-scoped via EntityAccess)
     investor = "investor"
-    fund_administrator = "fund_administrator"
+    fund_administrator = "fund_administrator"        # "Administrator" — manages its funds
+    administrator_viewer = "administrator_viewer"    # "Administrator (view only)" — reads its funds
 
 
 # External roles see only the entities granted to them.
-EXTERNAL_ROLES = (UserRole.investor, UserRole.fund_administrator)
+EXTERNAL_ROLES = (UserRole.investor, UserRole.fund_administrator, UserRole.administrator_viewer)
 
 
 class DocumentCategory(str, enum.Enum):