Restrict platform-list edits to admins

Anyone authenticated can still read the shared platform list, but only an
admin may add, rename or delete from it.

- users.is_admin boolean, defaulting to false. The very first account ever
  registered becomes an admin automatically (CreateUser's INSERT uses
  NOT EXISTS (SELECT 1 FROM users) for is_admin), so there's always at
  least one without manual setup; promoting anyone beyond that is a manual
  UPDATE for now (documented in the migration's comment on the column).
- GetSessionAndUser, GetUserByEmail and GetUserByID now also select
  is_admin, and it flows through to model.User (and so to
  /api/auth/{register,login,me}'s response) and to the auth middleware's
  authedUser.
- New requireAdminMiddleware + addAdminAuth, layered on top of the existing
  auth middleware. Wired onto create/update/delete-platform; list/get stay
  on plain addAuth, since reading the list only requires being logged in.

Verified end to end: the first registered user comes back is_admin:true,
the second false; the non-admin gets 403 on create/update/delete-platform
but 200 on list; the admin can do all of it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/api/context.go

@@ -11,10 +11,11 @@ import (
 // authedUser is what AuthMiddleware stores in the request context after
 // validating a session token. Handlers read it with userFromContext.
 type authedUser struct {
-	ID    uuid.UUID
-	Email string
-	Name  string
-	Bio   string
+	ID      uuid.UUID
+	Email   string
+	Name    string
+	Bio     string
+	IsAdmin bool
 }
 
 type ctxKey string
@@ -22,7 +23,7 @@ type ctxKey string
 const userCtxKey ctxKey = "completed.user"
 
 func (u authedUser) toModel() model.User {
-	return model.User{ID: u.ID.String(), Email: u.Email, Name: u.Name, Bio: u.Bio}
+	return model.User{ID: u.ID.String(), Email: u.Email, Name: u.Name, Bio: u.Bio, IsAdmin: u.IsAdmin}
 }
 
 // userFromContext returns the authenticated user set by AuthMiddleware. It