0.2.42: external Administrator role with entity-scoped management

The external fund_administrator role (relabeled Administrator) now signs
into the full admin interface, fenced to the funds and SPVs granted to
it via EntityAccess:

- Partners, capital accounts, documents (upload and delete), entity
  edits, and eNAV imports for its own funds only; no fund creation,
  valuation sign-off, audit log, or investor view.
- Scoped user management: sees and manages only investors tied to its
  funds; creates investor accounts only; updates preserve grants on
  funds outside its scope.
- New DELETE /api/users/{id} (in-app Delete user button) with the
  cascade cleanup factored out of the CLI; Service Admin and self are
  protected, and an Administrator can only delete an investor who
  belongs solely to its funds.
- Internal fund_admin relabeled 'Staff (all funds)' and dropped from
  the create picker to end the two-similar-names confusion.
- Version badge removed from the UI (sidebar and portal header); the
  build version now logs to the browser console instead.
- deploy/.startos (signing key) added to .gitignore.

backend/ten31portal/routers/capital_import_router.py

@@ -20,7 +20,7 @@ from sqlmodel import Session, select
 
 from ten31portal import config, storage
 from ten31portal.audit import record_audit
-from ten31portal.auth import hash_password, require_internal_admin
+from ten31portal.auth import check_administrator_scope, hash_password, require_admin
 from ten31portal.database import get_session
 from ten31portal.models import (
     CapitalAccountStatement, Entity, EntityAccess, User, UserRole,
@@ -222,9 +222,11 @@ def preview_import(
     entity_id: int | None = Form(None),
     row_index: int | None = Form(None),
     password: str | None = Form(None),
-    admin: User = Depends(require_internal_admin),
+    admin: User = Depends(require_admin),
     session: Session = Depends(get_session),
 ) -> CapitalImportPreview:
+    if entity_id is not None:
+        check_administrator_scope(admin, entity_id, session)
     if entity_id is not None and session.get(Entity, entity_id) is None:
         raise HTTPException(status_code=404, detail="Entity not found")
 
@@ -289,9 +291,10 @@ def preview_import(
 @router.post("/commit")
 def commit_import(
     body: CapitalImportCommit,
-    admin: User = Depends(require_internal_admin),
+    admin: User = Depends(require_admin),
     session: Session = Depends(get_session),
 ) -> dict:
+    check_administrator_scope(admin, body.entity_id, session)
     entity = session.get(Entity, body.entity_id)
     if entity is None:
         raise HTTPException(status_code=404, detail="Entity not found")
@@ -395,7 +398,7 @@ def batch_import(
     files: list[UploadFile] = File(...),
     entity_id: int = Form(...),
     password: str | None = Form(None),
-    admin: User = Depends(require_internal_admin),
+    admin: User = Depends(require_admin),
     session: Session = Depends(get_session),
 ) -> BatchCapitalImportResult:
     """Backfill several quarters of capital history for one fund from a batch of eNAV files.
@@ -407,6 +410,7 @@ def batch_import(
     (no account creation). One file failing (bad password, no ALLOC SI, unreadable date) is
     reported per-file and does not abort the rest.
     """
+    check_administrator_scope(admin, entity_id, session)
     entity = session.get(Entity, entity_id)
     if entity is None:
         raise HTTPException(status_code=404, detail="Entity not found")