Add an instance owner/operator role (env-declared via OWNER_EMAIL)

Provenance had no system-level owner: ownership was only per-tree
(TreeMembership), so a self-hosted instance had no operator account and no
instance-admin surface. This adds one, declared by environment per the project's
twelve-factor rule.

- OWNER_EMAIL (comma-separated): the account(s) named here are instance owners.
  Derived at request time — no DB column, no migration, can't drift from the env,
  survives DB resets. is_instance_owner()/InstanceOwner dependency in api/deps.py.
- Ownership requires a VERIFIED email (independent of REQUIRE_EMAIL_VERIFICATION).
  Registration is open, so without this an attacker could seize the role by
  registering the owner address first; verification ties it to inbox control.
- GET /api/v1/admin/instance (owner-only): operational status — version, env,
  user/tree counts, configured AI providers. Deliberately exposes no tree data
  or PII: instance ownership is an operator role, NOT a privacy-engine bypass.
- /users/me reports is_instance_owner; frontend gains an owner-only /admin page
  and a conditional sidebar link (server-enforced, not just client-hidden).

Found-and-fixed by an adversarial security review before merge: the
verified-email land-grab (above) and a frontend null-deref where the admin page
crashed on 401/5xx instead of failing closed.

Docs: .env.example + ARCHITECTURE (notes the not-a-privacy-bypass boundary and
the verified-email requirement). Tests: owner matching, the land-grab guard,
/users/me, and owner-only /admin. Suite 96 passing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

frontend/lib/api/schema.d.ts

@@ -1049,6 +1049,26 @@ export interface paths {
         patch: operations["update_ai_policy_api_v1_trees__tree_id__ai_patch"];
         trace?: never;
     };
+    "/api/v1/admin/instance": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Instance Status
+         * @description Operator dashboard data. Requires the caller to be an instance owner.
+         */
+        get: operations["instance_status_api_v1_admin_instance_get"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -1418,6 +1438,25 @@ export interface components {
             /** Unmapped Tags */
             unmapped_tags: string[];
         };
+        /** InstanceStatus */
+        InstanceStatus: {
+            /** Version */
+            version: string;
+            /** Env */
+            env: string;
+            /** Owner Emails */
+            owner_emails: string[];
+            /** Require Email Verification */
+            require_email_verification: boolean;
+            /** User Count */
+            user_count: number;
+            /** Tree Count */
+            tree_count: number;
+            /** Default Llm Provider */
+            default_llm_provider: string;
+            /** Ai Providers */
+            ai_providers: components["schemas"]["ConfiguredProvider"][];
+        };
         /** LoginRequest */
         LoginRequest: {
             /** Email */
@@ -1998,6 +2037,11 @@ export interface components {
              * Format: date-time
              */
             created_at: string;
+            /**
+             * Is Instance Owner
+             * @default false
+             */
+            is_instance_owner?: boolean;
         };
         /** UserSelfPersonUpdate */
         UserSelfPersonUpdate: {
@@ -4760,4 +4804,24 @@ export interface operations {
             };
         };
     };
+    instance_status_api_v1_admin_instance_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InstanceStatus"];
+                };
+            };
+        };
+    };
 }