Make the admin a member with a flag, and drop the second listener

The admin was a set of env credentials on its own loopback listener. That
bought network isolation, and charged a second port to tunnel and proxy and
a second credential in the password manager. It also sat outside the
SameSite protection the member cookie already had, and left every ban and
password reset with no actor to log.

is_admin on users reuses what was already there: the session, the login
rate limiter, ban-drops-sessions, CSRF. /admin is now a route on the member
mux. A member without the flag gets 404 rather than 403 — the pages are
none of their business, and "forbidden" confirms there is something to be
forbidden from.

Registration needs an invite and invites come from /admin, so an empty
database cannot grow its first user. seedAdmin breaks that circle exactly
once, from ADMIN_EMAIL and ADMIN_PASSWORD, and does nothing against a
database that already has users.

An admin cannot ban themselves: banning drops the target's sessions, and
nothing would be left that could undo it.

This reverses decision 8, which is rewritten rather than deleted, along
with the admin entry in the CONTEXT.md vocabulary.

.env.example

@@ -1,10 +1,14 @@
-# Copy to .env and edit. The admin password has no default.
-ADMIN_USER=admin
+# Copy to .env and edit.
+
+# The first account. Only read when the database has no users: the app creates that account,
+# marks it admin, and ignores these afterwards. Everyone else joins by invite.
+ADMIN_EMAIL=
 ADMIN_PASSWORD=
+ADMIN_NAME=Ylläpito
 
 # Set to false only for local development over plain HTTP.
 SECURE_COOKIES=true
 
-# Public address of the member site. Used to build pasteable invite links in the admin panel.
+# Public address of the site. Used to build pasteable invite links on the admin page.
 # Unset falls back to a relative link, which is fine locally.
 PUBLIC_URL=https://levyraati.example.com