Restrict platform-list edits to admins

Anyone authenticated can still read the shared platform list, but only an
admin may add, rename or delete from it.

- users.is_admin boolean, defaulting to false. The very first account ever
  registered becomes an admin automatically (CreateUser's INSERT uses
  NOT EXISTS (SELECT 1 FROM users) for is_admin), so there's always at
  least one without manual setup; promoting anyone beyond that is a manual
  UPDATE for now (documented in the migration's comment on the column).
- GetSessionAndUser, GetUserByEmail and GetUserByID now also select
  is_admin, and it flows through to model.User (and so to
  /api/auth/{register,login,me}'s response) and to the auth middleware's
  authedUser.
- New requireAdminMiddleware + addAdminAuth, layered on top of the existing
  auth middleware. Wired onto create/update/delete-platform; list/get stay
  on plain addAuth, since reading the list only requires being logged in.

Verified end to end: the first registered user comes back is_admin:true,
the second false; the non-admin gets 403 on create/update/delete-platform
but 200 on list; the admin can do all of it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/api/auth_routes.go

@@ -93,7 +93,7 @@ func registerAuthRoutes(api huma.API, queries db.Querier) {
 			SetCookie: sessionCookie(token),
 			Body: model.AuthResponse{
 				Token: token,
-				User:  model.User{ID: u.ID.String(), Email: u.Email, Name: u.Name},
+				User:  model.User{ID: u.ID.String(), Email: u.Email, Name: u.Name, IsAdmin: u.IsAdmin},
 			},
 		}, nil
 	})
@@ -126,7 +126,7 @@ func registerAuthRoutes(api huma.API, queries db.Querier) {
 			SetCookie: sessionCookie(token),
 			Body: model.AuthResponse{
 				Token: token,
-				User:  model.User{ID: u.ID.String(), Email: u.Email, Name: u.Name},
+				User:  model.User{ID: u.ID.String(), Email: u.Email, Name: u.Name, IsAdmin: u.IsAdmin},
 			},
 		}, nil
 	})