0.2.42: external Administrator role with entity-scoped management

The external fund_administrator role (relabeled Administrator) now signs
into the full admin interface, fenced to the funds and SPVs granted to
it via EntityAccess:

- Partners, capital accounts, documents (upload and delete), entity
  edits, and eNAV imports for its own funds only; no fund creation,
  valuation sign-off, audit log, or investor view.
- Scoped user management: sees and manages only investors tied to its
  funds; creates investor accounts only; updates preserve grants on
  funds outside its scope.
- New DELETE /api/users/{id} (in-app Delete user button) with the
  cascade cleanup factored out of the CLI; Service Admin and self are
  protected, and an Administrator can only delete an investor who
  belongs solely to its funds.
- Internal fund_admin relabeled 'Staff (all funds)' and dropped from
  the create picker to end the two-similar-names confusion.
- Version badge removed from the UI (sidebar and portal header); the
  build version now logs to the browser console instead.
- deploy/.startos (signing key) added to .gitignore.

backend/ten31portal/routers/import_router.py

@@ -18,7 +18,7 @@ from sqlmodel import Session, select, col
 
 from ten31portal import storage
 from ten31portal.audit import record_audit
-from ten31portal.auth import require_role
+from ten31portal.auth import check_administrator_scope, require_admin, require_role
 from ten31portal.database import get_session
 from ten31portal.models import (
     BtcPrice, Entity, EntityType, Holding, Position,
@@ -341,9 +341,17 @@ def import_schedule(
     commit: bool = Query(default=True),
     replace_existing: bool = Query(default=False),
     password: str | None = Form(default=None),
-    user: User = Depends(require_role(UserRole.approver, UserRole.cfo, UserRole.operations)),
+    user: User = Depends(require_admin),
     session: Session = Depends(get_session),
 ) -> dict[str, Any]:
+    # An Administrator imports only into a fund granted to them — creating a new entity
+    # (or name-matching into an arbitrary one) is internal-only.
+    if user.role == UserRole.fund_administrator:
+        if entity_id is None:
+            raise HTTPException(
+                status_code=403, detail="Choose one of your funds to import into."
+            )
+        check_administrator_scope(user, entity_id, session)
     try:
         file_bytes = storage.read_capped(file)
     except storage.UploadTooLarge as exc: