Backfill sparse report sections, add enrichment section refresh, and bootstrap first-admin

Reports: the LLM reliably used company_enrichment for prose fields but
inconsistently populated the parallel Finding-list/string-list fields from
the same evidence, even with progressively more explicit prompting. Add a
code-level backfill (products, recent developments, financial signals,
strategic initiatives, regulatory signals, risks/opportunities mirrored
from SWOT, unknowns, monitoring recommendations) that only ever fills in
what the model left empty, never overwrites what it produced.

Enrichment tab: reorder sections (Products/Recent updates before
Customers/Competitors) and add a per-section "Refresh" button that
re-fetches just one of NinjaPear's six independent per-company endpoints
when it came back empty - confirmed live that a data-coverage gap (e.g.
Amazon returning no products) is real provider behavior, not a bug.

Auth: the first account registered on a deployment with zero existing
admins is now auto-promoted to admin, closing the chicken-and-egg gap
where the only path to admin access was direct DB access. Self-heals if
the last admin ever deletes their account.

Also bumps nginx's proxy_read_timeout for api.ciagent.org to cover the
enrichment refresh's synchronous funding-endpoint call (up to 5 minutes
per NinjaPear's docs).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/web/lib/api-client.ts

@@ -16,6 +16,7 @@ import type {
   DeleteAccountPayload,
   DiscoverCompanyRequest,
   DiscoveredCompanyProfile,
+  EnrichmentSection,
   IpBan,
   LogEntry,
   LoginPayload,
@@ -316,6 +317,12 @@ export const api = {
   resumeCompany: (companyId: string) =>
     request<CompanyResponse>(`/api/v1/companies/${companyId}/resume`, { method: "POST" }),
 
+  refreshEnrichmentSection: (companyId: string, section: EnrichmentSection) =>
+    request<CompanyResponse>(
+      `/api/v1/companies/${companyId}/enrichment/sections/${section}/refresh`,
+      { method: "POST" },
+    ),
+
   updateMonitorConfiguration: (companyId: string, payload: MonitorConfigurationUpdatePayload) =>
     request<MonitorConfigurationResponse>(`/api/v1/companies/${companyId}/monitor`, {
       method: "PATCH",