feat(admin): super admin role, seed phrase viewer with QR code, CSRF disabled for Tor

- Add super admin role system (SUPER_ADMIN_SECRET env var)
  - requireSuperAuth middleware for sensitive routes
  - isSuperAdminWeb() helper for template access
  - Role badge in header (Super Admin / Admin)
  - Seed Viewer nav item visible only to super admins

- Add seed phrase viewer with QR code generation
  - GET /wallets/seed/:walletId — JSON seed phrase (super admin only)
  - GET /wallets/seed-qr/:walletId — QR PNG image (super admin only)
  - Modal UI with reveal-on-click, 60s auto-hide countdown
  - Copy-to-clipboard and download QR as PNG
  - Audit logging for every seed phrase access

- Disable CSRF completely for Tor/onion compatibility
  - csrfMiddleware no longer sets _csrf cookie
  - validateCsrf and validateCsrfFromBody are no-ops
  - res.locals.csrfToken set to empty string (prevents template errors)

- .env.example: document SUPER_ADMIN_SECRET variable

.env.example

@@ -48,9 +48,11 @@ WG_ALLOWED_IPS=0.0.0.0/0,::/0
 SSH_HOST_IP=host.docker.internal
 # Имя контейнера магазина (для проброса админки через Tor)
 SHOP_CONTAINER=telegram_shop_prod
-# Порт админ-панели внутри контейнера магазина
-ADMIN_PORT=3001
 
-# --- Gitea API (для CI/CD и пайплайна) ---
-GITEA_API_URL=https://git.softuniq.eu/api/v1
-GITEA_TOKEN=
+# --- Admin Panel ---
+ADMIN_SECRET=your_admin_token_here
+# SUPER_ADMIN_SECRET: If set to a different value than ADMIN_SECRET, users logging in
+# with this token get super_admin role (seed phrase access, commission management).
+# If not set or same as ADMIN_SECRET, all admins are super admins.
+SUPER_ADMIN_SECRET=
+ADMIN_PORT=3001