Add an instance owner/operator role (env-declared via OWNER_EMAIL)

Provenance had no system-level owner: ownership was only per-tree
(TreeMembership), so a self-hosted instance had no operator account and no
instance-admin surface. This adds one, declared by environment per the project's
twelve-factor rule.

- OWNER_EMAIL (comma-separated): the account(s) named here are instance owners.
  Derived at request time — no DB column, no migration, can't drift from the env,
  survives DB resets. is_instance_owner()/InstanceOwner dependency in api/deps.py.
- Ownership requires a VERIFIED email (independent of REQUIRE_EMAIL_VERIFICATION).
  Registration is open, so without this an attacker could seize the role by
  registering the owner address first; verification ties it to inbox control.
- GET /api/v1/admin/instance (owner-only): operational status — version, env,
  user/tree counts, configured AI providers. Deliberately exposes no tree data
  or PII: instance ownership is an operator role, NOT a privacy-engine bypass.
- /users/me reports is_instance_owner; frontend gains an owner-only /admin page
  and a conditional sidebar link (server-enforced, not just client-hidden).

Found-and-fixed by an adversarial security review before merge: the
verified-email land-grab (above) and a frontend null-deref where the admin page
crashed on 401/5xx instead of failing closed.

Docs: .env.example + ARCHITECTURE (notes the not-a-privacy-bypass boundary and
the verified-email requirement). Tests: owner matching, the land-grab guard,
/users/me, and owner-only /admin. Suite 96 passing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

frontend/components/app-sidebar.tsx

@@ -12,6 +12,7 @@ import {
   LogOut,
   Network,
   Settings,
+  ShieldCheck,
   Sparkles,
   UserPlus,
   Users,
@@ -30,7 +31,11 @@ export function AppSidebar({ onNavigate }: { onNavigate?: () => void }) {
   const segs = pathname.split("/").filter(Boolean); // ["trees", "<id>", ...]
   const treeId = segs[0] === "trees" && segs[1] ? segs[1] : null;
   const [treeName, setTreeName] = useState<string | null>(null);
-  const [me, setMe] = useState<{ display_name: string | null; email: string } | null>(null);
+  const [me, setMe] = useState<{
+    display_name: string | null;
+    email: string;
+    is_instance_owner?: boolean;
+  } | null>(null);
   const [menuOpen, setMenuOpen] = useState(false);
   const menuRef = useRef<HTMLDivElement>(null);
 
@@ -98,6 +103,14 @@ export function AppSidebar({ onNavigate }: { onNavigate?: () => void }) {
       <Item href="/trees" label="Trees" icon={FolderTree} active={pathname === "/trees"} />
       <Item href="/explore" label="Explore" icon={Compass} active={pathname === "/explore"} />
       <Item href="/import" label="Import" icon={ArrowDownUp} active={pathname === "/import"} />
+      {me?.is_instance_owner && (
+        <Item
+          href="/admin"
+          label="Admin"
+          icon={ShieldCheck}
+          active={pathname.startsWith("/admin")}
+        />
+      )}
 
       {treeId && (
         <div className="mt-5 flex flex-col gap-1">