feat(admin): account roles and the instance_members index

Phase 2 created cloud instances without recording who owns them on this
side, because the collection did not exist. The boot backfill reconstructs
one member row per instance from the hq-sourced control-plane owner, and
marks every existing customer_user an owner — they all created their own
account.

Backfill lives in models rather than db: db is the connection layer and
models already imports it for SeedPlans, so db -> models would cycle.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

admin/cmd/main.go

@@ -67,6 +67,10 @@ func main() {
 		idxCancel()
 		log.Fatalf("plan seed: %v", err)
 	}
+	if err := models.Backfill(idxCtx); err != nil {
+		idxCancel()
+		log.Fatalf("backfill: %v", err)
+	}
 	idxCancel()
 
 	reconcileCtx, stopReconcile := context.WithCancel(context.Background())