0.2.45: Administrator (view only) role

New external role administrator_viewer: signs into the admin interface
and reads everything for its granted funds and SPVs (overview, partners,
capital accounts with every investor's statements, documents, valuation
history) but every write is refused: no imports, uploads, deletions,
entity edits, exit marking, or account management. No migration needed;
roles are stored as strings.

Internal admins can flip an Administrator between full management and
view only via a new Access level dropdown in Users > Manage. The
user-list endpoint is read-widened for the viewer role so investor names
resolve on its screens; all mutating endpoints keep the stricter gate.

deploy/startos/install/versions/v_0_2_45.ts

@@ -0,0 +1,18 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_45 = VersionInfo.of({
+  version: '0.2.45:0',
+  releaseNotes: {
+    en_US:
+      'New "Administrator (view only)" role: sees everything an Administrator sees for ' +
+      'its granted funds and SPVs (overview, partners, capital accounts, documents, ' +
+      'valuation history) but can change nothing — no imports, uploads, deletions, or ' +
+      'account management. Create accounts with it directly, or switch an existing ' +
+      'Administrator between full management and view only from Users, then Manage, ' +
+      'then Access level.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})