Multiple admins

Adds Player.is_admin (creator starts with it; backfilled by migration).
Admin-key-authenticated POST /admin/set-admin grants/revokes it from the
admin panel; the creator's privileges can't be revoked. Admin-gated
backend routes (dev mode, skip character creation) and frontend controls
(corner menu, lobby start, scene start, end story) now check is_admin
instead of is_creator, and admins get the admin_key in their state blob
so granted players can open the admin panel.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/pirats/main.py

@@ -86,7 +86,8 @@ def get_game_state(game_id: str, player_id: str, db: Session = Depends(get_sessi
     events, events_have_more = crud.get_events_page(db, game_id, limit=EVENT_PAGE_SIZE)
 
     return {
-        "game": game.model_dump(exclude={"admin_key"}),
+        # admin_key stays hidden except from Admins, who need it to open the admin panel
+        "game": game.model_dump(exclude=(set() if player.is_admin else {"admin_key"})),
         "player": player.model_dump(),
         "players": [p.model_dump() for p in game.players],
         "obstacles": [o.model_dump() for o in game.obstacles],