Add admin dashboard (issue #11) + admin API routes

- New src/dashboard.html: vanilla JS SPA with login (bearer token),
  Overview stats, Calendar month view with color-coded dots,
  Bookings table with expandable payment block and confirm action,
  Payments panel with revenue summary and CSV export
- api/server.js: admin routes behind requireAdmin middleware:
  GET /api/admin/stats, GET /api/admin/bookings, PATCH /api/admin/bookings/:id,
  GET /api/admin/payments/export; PATCH fires payment_confirmed n8n event
- nginx.conf: /dashboard location serves dashboard.html
- api/.env.example: add ADMIN_SECRET placeholder

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nginx.conf

@@ -60,6 +60,11 @@ http {
             add_header Cache-Control "public, must-revalidate";
         }
 
+        # Admin dashboard
+        location /dashboard {
+            try_files $uri /dashboard.html;
+        }
+
         # SPA fallback
         location / {
             try_files $uri $uri/ /index.html;