feat: establish platform administration foundation

[darwin67]

Summary

• resolve and publish RFD 1's platform administration security and lifecycle decisions
• add constrained platform roles, account suspension state, and append-only platform audit events
• add fresh context, Plug, and LiveView authorization for platform administrators
• add audited grant, revoke, transfer, suspension, restoration, and platform-admin account deletion flows
• serialize authority changes so concurrent operations cannot remove the final active administrator
• serialize session, API, and magic-link token issuance with suspension
• preserve constant-time password verification for missing and suspended accounts
• add an idempotent release bootstrap command for initial access and emergency recovery

Scope

This PR intentionally provides the backend and authorization baseline only. It does not add admin routes, navigation, templates, or panel controls. Paginated admin queries and the initial panel will follow in smaller reviewable commits after this foundation lands.

Admin LiveViews will be placed in the existing authenticated :require_authenticated_user pipeline and live session because all panel routes require login. The platform-admin hook adds the separate installation-wide authorization boundary.

Review follow-ups

An Oracle review identified and this branch now covers:

• token issuance racing suspension and surviving restoration
• password-authentication timing differences for missing or suspended users
• missing suspension/account-deletion concurrency coverage
• missing tests using real organization owner and admin memberships

The token race regression failed against the original implementation before the locking fix.

Validation

• mix precommit — 477 tests passed
• deterministic session/API/magic-link issuance-versus-suspension regression
• concurrent revocation, suspension, and account-deletion coverage
• migration rollback and forward application
• make check-rfds
• shellcheck rel/overlays/bin/grant-platform-admin
• sh -n rel/overlays/bin/grant-platform-admin