0.2.42: external Administrator role with entity-scoped management

The external fund_administrator role (relabeled Administrator) now signs
into the full admin interface, fenced to the funds and SPVs granted to
it via EntityAccess:

- Partners, capital accounts, documents (upload and delete), entity
  edits, and eNAV imports for its own funds only; no fund creation,
  valuation sign-off, audit log, or investor view.
- Scoped user management: sees and manages only investors tied to its
  funds; creates investor accounts only; updates preserve grants on
  funds outside its scope.
- New DELETE /api/users/{id} (in-app Delete user button) with the
  cascade cleanup factored out of the CLI; Service Admin and self are
  protected, and an Administrator can only delete an investor who
  belongs solely to its funds.
- Internal fund_admin relabeled 'Staff (all funds)' and dropped from
  the create picker to end the two-similar-names confusion.
- Version badge removed from the UI (sidebar and portal header); the
  build version now logs to the browser console instead.
- deploy/.startos (signing key) added to .gitignore.

backend/ten31portal/routers/round_router.py

@@ -6,7 +6,10 @@ from fastapi import APIRouter, Depends, HTTPException
 from sqlmodel import Session, select, col
 
 from ten31portal.audit import record_audit
-from ten31portal.auth import require_internal, require_writer, require_approver
+from ten31portal.auth import (
+    check_administrator_scope, require_internal_or_administrator, require_writer,
+    require_approver,
+)
 from ten31portal.database import get_session
 from ten31portal.models import (
     Entity, Holding, Position, Valuation, ValuationRound,
@@ -30,9 +33,10 @@ def _round_response(round: ValuationRound, session: Session) -> RoundResponse:
 @router.get("/api/entities/{entity_id}/rounds")
 def list_rounds(
     entity_id: int,
-    user: User = Depends(require_internal),
+    user: User = Depends(require_internal_or_administrator),
     session: Session = Depends(get_session),
 ) -> list[RoundResponse]:
+    check_administrator_scope(user, entity_id, session)
     entity = session.get(Entity, entity_id)
     if entity is None:
         raise HTTPException(status_code=404, detail="Entity not found")
@@ -47,12 +51,13 @@ def list_rounds(
 @router.get("/api/rounds/{round_id}")
 def get_round(
     round_id: int,
-    user: User = Depends(require_internal),
+    user: User = Depends(require_internal_or_administrator),
     session: Session = Depends(get_session),
 ) -> RoundResponse:
     round = session.get(ValuationRound, round_id)
     if round is None:
         raise HTTPException(status_code=404, detail="Round not found")
+    check_administrator_scope(user, round.entity_id, session)
     return _round_response(round, session)