Release 0.2.22: capital chart, Investor View, GP stakes, doc folders

Snapshot commit bringing the uncommitted phase-2 work into version control
together with four new features and the 0.2.22 version bump.

New features:
- Investor capital-over-time chart (value, paid-in, distributions per
  quarter), rendered from existing capital-account history.
- Admin Investor View: read-only reconstruction of an investor's portal
  (GET /api/users/{id}/investor-view), reusing the investor portal UI.
- Document upload scoped to the selected fund's own investors, with an
  explicit upload-target confirmation to prevent mis-attaching.
- GP/mgmt entities gain an Assets tab listing their stakes in the funds
  they manage (new entity_stakes table + /api/entities/{id}/stakes).
- Edit-entity form (change type/status/etc.), so GP entities can be
  categorized correctly.

Verified: 11/11 backend tests pass; alembic upgrades to head b8c9d0e1f2a3;
frontend tsc + vite build clean; s9pk packs at 0.2.22:0 (x86_64).
Also: ignore .DS_Store and *.s9pk artifacts.

deploy/Dockerfile

@@ -1,7 +1,10 @@
 # Build context is the repo root (docker build -f deploy/Dockerfile .)
 
 # --- Frontend build stage ---
-FROM node:20-slim AS frontend-build
+# Build on the native builder arch ($BUILDPLATFORM) so the JS bundler runs without
+# cross-arch emulation. The output is static assets (HTML/CSS/JS), which are
+# architecture-independent and copied into the target-arch runtime stage below.
+FROM --platform=$BUILDPLATFORM node:20-slim AS frontend-build
 
 WORKDIR /build
 COPY frontend/package.json frontend/package-lock.json ./
@@ -32,7 +35,8 @@ RUN chmod +x ./start.sh
 RUN mkdir -p /data
 
 ENV TEN31_DB_PATH=/data/portal.db
-ENV TEN31_SESSION_SECRET=***
+ENV TEN31_DOCS_DIR=/data/documents
+ENV TEN31_SESSION_SECRET=change-me
 
 EXPOSE 8000