refactor: flatten admin routes, redesign core pages, single access tier

[matejstastny]

Collapses the two-tier permission system to a single access tier. Removes role and canAccessVault from the user model, plus the entire per-feature grant system (userFeature table, features.ts, /features page, FEATURE_ROUTES middleware logic). Every approved account is now full-access; the approve/deactivate onboarding gate is unchanged. Vault entries move from an admin-always-reads model to per-entry grants for everyone, with the creator auto-granted on create.

Drops the /admin/* URL prefix and merges each admin/member page pair into one page:

• /orders: personal + team + queue
• /minecraft: status + whitelist + collapsible server control
• /network: status + device management
• /finance: moved to top-level unchanged
• /members: new tabbed page replacing admin/users, admin/onshape, and admin/github

Sidebar and top nav collapse to one flat nav list now that every route is ungated by role. Nav order is Dashboard, Orders, Finance, Members, API Keys, Network, Minecraft; Quick Access mirrors it minus Dashboard itself.

Adds Tabs and EmptyState primitives. TableHead/TableCell no longer force whitespace-nowrap globally; date and currency columns opt in explicitly where wrapping would look bad. EmptyState replaces the duplicated "not configured" block on the Onshape and GitHub admin pages.

Darkens the neutral scale (background/card/muted/border/sidebar) to match the docs site; primary/secondary/foreground unchanged, contrast re-checked at the new values (all ratios >= 5:1). Sign-in page gets a CSS-only layered background (radial color blobs + a slowly drifting dot grid). Dashboard home drops the admin-ops-console layout (stats grid, SystemVitals) for a landing page everyone sees: greeting + clock, live Minecraft/network status tiles, and a quick-links grid to every top-level page.

Redesigns per feedback:

• Dashboard: replaces the live-status tiles with an Action Items list (orders needing triage/approval, approved orders awaiting purchase, pending member approvals, open whitelist requests)
• Minecraft: merges the personal whitelist-request form and admin whitelist-management table into one section, wiring the already-scaffolded whitelistDirectAddSchema/addedDirectly fields into a real POST /api/admin/whitelist endpoint since the two-step member-request/admin-approve flow was pure friction now that every approved account can approve
• Network: drops the redundant NodeList (device management table already shows everything), restyles the status summary to match the page background instead of a raised card, replaces the OS text column with a small icon next to each device name, increases left padding on the online/offline dot column
• Members: tab switcher is now a primary-colored segmented control with icons instead of the default small Tabs style
• Site-wide: TopNav now carries a title + description per route, so every dashboard page drops its own redundant <h1>/<p> header block

Reworks order floating windows and adds improved blur/scroll behavior. Adds more finance buckets to the seed script. Refactors staging scripts (stage-server.sh -> stage-server.ts, adds copy-prod-db-for-staging.ts and wipe-staging-sessions.ts).

Includes migration 0013_lowly_dagger.sql for the schema changes above.