Release 0.2.22: capital chart, Investor View, GP stakes, doc folders

Snapshot commit bringing the uncommitted phase-2 work into version control
together with four new features and the 0.2.22 version bump.

New features:
- Investor capital-over-time chart (value, paid-in, distributions per
  quarter), rendered from existing capital-account history.
- Admin Investor View: read-only reconstruction of an investor's portal
  (GET /api/users/{id}/investor-view), reusing the investor portal UI.
- Document upload scoped to the selected fund's own investors, with an
  explicit upload-target confirmation to prevent mis-attaching.
- GP/mgmt entities gain an Assets tab listing their stakes in the funds
  they manage (new entity_stakes table + /api/entities/{id}/stakes).
- Edit-entity form (change type/status/etc.), so GP entities can be
  categorized correctly.

Verified: 11/11 backend tests pass; alembic upgrades to head b8c9d0e1f2a3;
frontend tsc + vite build clean; s9pk packs at 0.2.22:0 (x86_64).
Also: ignore .DS_Store and *.s9pk artifacts.

README.md

@@ -2,6 +2,31 @@
 
 Internal system of record for Ten31 entities, holdings, positions, and quarterly valuation sign-off.
 
+## Accounts and access
+
+Two kinds of accounts:
+
+- **Internal staff** (`approver`, `cfo`, `fund_admin`, `viewer`) — the full back-office app
+  (entities, holdings, valuations, import, audit). `approver` and `cfo` also get the
+  admin screens below.
+- **External accounts** (`investor`, `fund_administrator`) — a separate, entity-scoped
+  portal. An external account only sees the entities granted to it.
+  - **Investor** — sees, per fund, their latest capital-account value and history, plus
+    documents shared to the fund or addressed privately to them (e.g. their K-1).
+  - **Fund administrator** — sees assigned entities and can upload documents for them
+    (shared or addressed to a specific investor).
+
+Admin screens (Users / Documents / Capital Accounts, visible to `approver` and `cfo`)
+let you create an account with a username and password, check off which entities it can
+view, upload documents, and enter each investor's capital-account figures.
+
+Login accepts a username **or** an email. The first admin is created from the CLI:
+
+```bash
+ten31portal-cli create-user --name "You" --username admin --role cfo --password '...'
+# --email is optional; external accounts are normally created from the Users screen.
+```
+
 ## Prerequisites
 
 - Python 3.11+