0.2.42: external Administrator role with entity-scoped management

The external fund_administrator role (relabeled Administrator) now signs
into the full admin interface, fenced to the funds and SPVs granted to
it via EntityAccess:

- Partners, capital accounts, documents (upload and delete), entity
  edits, and eNAV imports for its own funds only; no fund creation,
  valuation sign-off, audit log, or investor view.
- Scoped user management: sees and manages only investors tied to its
  funds; creates investor accounts only; updates preserve grants on
  funds outside its scope.
- New DELETE /api/users/{id} (in-app Delete user button) with the
  cascade cleanup factored out of the CLI; Service Admin and self are
  protected, and an Administrator can only delete an investor who
  belongs solely to its funds.
- Internal fund_admin relabeled 'Staff (all funds)' and dropped from
  the create picker to end the two-similar-names confusion.
- Version badge removed from the UI (sidebar and portal header); the
  build version now logs to the browser console instead.
- deploy/.startos (signing key) added to .gitignore.

frontend/src/api.ts

@@ -34,6 +34,13 @@ export const isInternal = (role: UserRole) => INTERNAL_ROLES.includes(role);
 export const isAdmin = (role: UserRole) => ADMIN_ROLES.includes(role);
 export const canEditRound = (role: UserRole) => WRITER_ROLES.includes(role);
 export const isApprover = (role: UserRole) => role === "approver";
+// The external Administrator: full management, but only inside their granted entities.
+export const isAdministrator = (role: UserRole) => role === "fund_administrator";
+// Can run the admin screens (users, documents, capital accounts, imports).
+export const isManager = (role: UserRole) => isAdmin(role) || isAdministrator(role);
+// Can edit entity records (partners, exits, fund details) — internal writers + Administrator.
+export const canManageEntity = (role: UserRole) =>
+  WRITER_ROLES.includes(role) || isAdministrator(role);
 
 export interface User {
   id: number;
@@ -576,6 +583,8 @@ export const api = {
       method: "PUT",
       body: JSON.stringify({ primary_account_id }),
     }),
+  deleteUser: (id: number) =>
+    request<{ status: string }>(`/api/users/${id}`, { method: "DELETE" }),
 
   // Documents
   listDocuments: (params?: { entity_id?: number; investor_user_id?: number }) => {