Backfill sparse report sections, add enrichment section refresh, and bootstrap first-admin

Reports: the LLM reliably used company_enrichment for prose fields but
inconsistently populated the parallel Finding-list/string-list fields from
the same evidence, even with progressively more explicit prompting. Add a
code-level backfill (products, recent developments, financial signals,
strategic initiatives, regulatory signals, risks/opportunities mirrored
from SWOT, unknowns, monitoring recommendations) that only ever fills in
what the model left empty, never overwrites what it produced.

Enrichment tab: reorder sections (Products/Recent updates before
Customers/Competitors) and add a per-section "Refresh" button that
re-fetches just one of NinjaPear's six independent per-company endpoints
when it came back empty - confirmed live that a data-coverage gap (e.g.
Amazon returning no products) is real provider behavior, not a bug.

Auth: the first account registered on a deployment with zero existing
admins is now auto-promoted to admin, closing the chicken-and-egg gap
where the only path to admin access was direct DB access. Self-heals if
the last admin ever deletes their account.

Also bumps nginx's proxy_read_timeout for api.ciagent.org to cover the
enrichment refresh's synchronous funding-endpoint call (up to 5 minutes
per NinjaPear's docs).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/api/tests/unit/test_auth.py

@@ -63,6 +63,40 @@ def test_register_rejects_weak_password(client):
     assert resp.status_code == 422
 
 
+async def test_first_registration_on_an_admin_less_deployment_becomes_admin(db_session, settings):
+    """Bootstraps admin access on a fresh deployment - without this, the
+    only way to ever get an admin account is direct DB access. Patches
+    count_admins() to simulate a genuinely admin-less deployment rather
+    than manipulating the shared session-wide test DB's real admin count
+    (conftest.py seeds one admin precisely so ordinary registrations in
+    other tests never accidentally trip this path)."""
+    from unittest.mock import patch
+
+    from app.repositories.user_repository import UserRepository
+    from app.schemas.auth import RegisterRequest
+    from app.services.auth_service import register
+
+    payload = RegisterRequest(
+        email=_unique_email(), password="correct-horse-1", display_name="First User"
+    )
+    with patch.object(UserRepository, "count_admins", return_value=0):
+        user = await register(db_session, settings, "127.0.0.1", payload)
+
+    assert user.is_admin is True
+
+
+async def test_registration_after_an_admin_already_exists_is_not_promoted(db_session, settings):
+    from app.schemas.auth import RegisterRequest
+    from app.services.auth_service import register
+
+    payload = RegisterRequest(
+        email=_unique_email(), password="correct-horse-1", display_name="Second User"
+    )
+    user = await register(db_session, settings, "127.0.0.1", payload)
+
+    assert user.is_admin is False
+
+
 def test_login_wrong_password_rejected(client):
     email = _unique_email()
     client.post(