feat: real-time messaging, Electron desktop app, admin drive portal

Messaging:
- Optimistic UI: message appears instantly in sender's view on send
- Skip WS relay-back of own messages to avoid duplicates
- Fix sent_at field name mismatch (sentAt → sent_at fallback)

Admin portal:
- /admin route: list all users, storage used vs quota, file count
- Inline-edit per-user storage quota (MB) and admin flag
- Stats header: total users, total storage, total files
- is_admin + storage_quota_mb columns added to users table
- Login response now includes isAdmin; sidebar shows Admin link for admins
- requireAdmin middleware on all /admin/* routes

Electron desktop app (desktop/):
- BrowserWindow with native title bar, system tray, hide-to-tray on close
- First-run setup dialog to configure self-hosted server URL
- Persists server URL via electron-store
- Tray menu: Open, Change server URL, Quit
- IPC: showNotification for future native push notifications
- electron-builder config for macOS (DMG), Windows (NSIS), Linux (AppImage)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/pages/LoginPage.tsx

@@ -34,14 +34,14 @@ export default function LoginPage() {
         return;
       }
 
-      const { accessToken, refreshToken, userId, username, kdfSalt, encryptedMasterKey } = res.data;
+      const { accessToken, refreshToken, userId, username, kdfSalt, encryptedMasterKey, isAdmin } = res.data;
 
       // Re-derive master key from password — never leaves the browser
       const derived = await deriveKeyFromPassword(password, kdfSalt);
       const masterKey = await decryptMasterKey(encryptedMasterKey, derived);
 
       // Set tokens first so the next API call has a Bearer token
-      setAuth({ accessToken, refreshToken, userId });
+      setAuth({ accessToken, refreshToken, userId, isAdmin });
       setMasterKey(masterKey);
       setUsername(username);