feat(adminsite): people, instance members and one password

The members panel is absent for self-hosted instances rather than disabled:
the backend refuses those, and a panel rendering controls the server will
reject is a panel that lies.

/auth/me now reports the caller's account role, so the UI hides what the
backend would refuse rather than discovering it in an error toast.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

admin/internal/api/customer.go

@@ -57,11 +57,15 @@ func getMe(c *gin.Context) {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "not signed in"})
 		return
 	}
-	c.JSON(http.StatusOK, gin.H{
-		"kind":       s.Kind,
-		"email":      s.Email,
-		"account_id": s.AccountID,
-	})
+	out := gin.H{"kind": s.Kind, "email": s.Email, "account_id": s.AccountID}
+	if s.Kind == auth.KindCustomer {
+		var u models.CustomerUser
+		if err := db.Admin("customer_users").FindOne(c.Request.Context(),
+			bson.M{"user_id": s.UserID}).Decode(&u); err == nil {
+			out["account_role"] = u.AccountRole
+		}
+	}
+	c.JSON(http.StatusOK, out)
 }
 
 func getAccount(c *gin.Context) {