0.2.42: external Administrator role with entity-scoped management

The external fund_administrator role (relabeled Administrator) now signs
into the full admin interface, fenced to the funds and SPVs granted to
it via EntityAccess:

- Partners, capital accounts, documents (upload and delete), entity
  edits, and eNAV imports for its own funds only; no fund creation,
  valuation sign-off, audit log, or investor view.
- Scoped user management: sees and manages only investors tied to its
  funds; creates investor accounts only; updates preserve grants on
  funds outside its scope.
- New DELETE /api/users/{id} (in-app Delete user button) with the
  cascade cleanup factored out of the CLI; Service Admin and self are
  protected, and an Administrator can only delete an investor who
  belongs solely to its funds.
- Internal fund_admin relabeled 'Staff (all funds)' and dropped from
  the create picker to end the two-similar-names confusion.
- Version badge removed from the UI (sidebar and portal header); the
  build version now logs to the browser console instead.
- deploy/.startos (signing key) added to .gitignore.

deploy/startos/install/versions/v_0_2_42.ts

@@ -0,0 +1,17 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_42 = VersionInfo.of({
+  version: '0.2.42:0',
+  releaseNotes: {
+    en_US:
+      'Administrator accounts: the external Administrator role now signs into the ' +
+      'full admin interface, scoped to the funds and SPVs granted to it — fund ' +
+      'overview, partners, capital accounts, documents (upload and delete), eNAV ' +
+      'imports, and investor account management (create, edit, reset, delete) for ' +
+      'its own funds only. Also carries the 0.2.41 static-path security fix.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})