Split admin setup and harden instance integrity

[sigilabcodex]

This PR:

• splits admin setup into focused section routes
• hardens user editing and owner/admin role integrity
• preserves sessions during safe user updates
• separates demo load, session clear, and destructive local reset
• derives team onboarding state from actual users
• prevents clean instances from inheriting demo operational records
• adds focused integrity regression fixtures

Checks:

• npm run build
• npm run typecheck

Manual rehearsal verified:

• destructive reset returns to uninitialized state
• bootstrap creates a clean instance
• owner login persists
• user creation does not reset the instance
• session clearing preserves users and instance data