Backfill sparse report sections, add enrichment section refresh, and bootstrap first-admin

Reports: the LLM reliably used company_enrichment for prose fields but
inconsistently populated the parallel Finding-list/string-list fields from
the same evidence, even with progressively more explicit prompting. Add a
code-level backfill (products, recent developments, financial signals,
strategic initiatives, regulatory signals, risks/opportunities mirrored
from SWOT, unknowns, monitoring recommendations) that only ever fills in
what the model left empty, never overwrites what it produced.

Enrichment tab: reorder sections (Products/Recent updates before
Customers/Competitors) and add a per-section "Refresh" button that
re-fetches just one of NinjaPear's six independent per-company endpoints
when it came back empty - confirmed live that a data-coverage gap (e.g.
Amazon returning no products) is real provider behavior, not a bug.

Auth: the first account registered on a deployment with zero existing
admins is now auto-promoted to admin, closing the chicken-and-egg gap
where the only path to admin access was direct DB access. Self-heals if
the last admin ever deletes their account.

Also bumps nginx's proxy_read_timeout for api.ciagent.org to cover the
enrichment refresh's synchronous funding-endpoint call (up to 5 minutes
per NinjaPear's docs).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/api/app/services/auth_service.py

@@ -125,11 +125,25 @@ async def register(
     if existing is not None:
         raise ConflictError("An account with this email already exists")
 
+    # Bootstraps admin access on a fresh deployment - otherwise the only way
+    # to ever get an admin account is direct DB access, which is a real
+    # chicken-and-egg problem for anyone self-hosting from a clean clone.
+    # Checked by admin *count*, not total user count, so this also
+    # self-heals if the last admin ever deletes their own account (Settings
+    # -> Delete account) - the next registration becomes admin again rather
+    # than leaving the deployment permanently admin-less. A benign race is
+    # possible if two people register in the same instant on a brand-new,
+    # zero-admin deployment (both could become admin) - acceptable for a
+    # bootstrapping check that only ever matters once, before any real
+    # traffic exists.
+    is_first_admin = await repo.count_admins() == 0
+
     user = await repo.create(
         email=payload.email,
         password_hash=hash_password(payload.password),
         display_name=payload.display_name,
         timezone=payload.timezone,
+        is_admin=is_first_admin,
         # Test suite has no inbox to read a real code from - same
         # app_env == "test" precedent already used to disable rate limiting
         # (app/core/rate_limit.py). The code-generation/sending/throttle