Add admin dashboard (issue #11) + admin API routes

- New src/dashboard.html: vanilla JS SPA with login (bearer token),
  Overview stats, Calendar month view with color-coded dots,
  Bookings table with expandable payment block and confirm action,
  Payments panel with revenue summary and CSV export
- api/server.js: admin routes behind requireAdmin middleware:
  GET /api/admin/stats, GET /api/admin/bookings, PATCH /api/admin/bookings/:id,
  GET /api/admin/payments/export; PATCH fires payment_confirmed n8n event
- nginx.conf: /dashboard location serves dashboard.html
- api/.env.example: add ADMIN_SECRET placeholder

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/.env.example

@@ -1,6 +1,9 @@
 PORT=3001
 CORS_ORIGIN=http://localhost:8080
 
+# Admin dashboard auth (issue #11) — set to a strong random passphrase
+ADMIN_SECRET=
+
 # n8n webhook for email notifications
 N8N_WEBHOOK_URL=
 PHOTOGRAPHER_EMAIL=hello@lisilou.com