feat(admin): read-only back-office at /admin (LAN-only)

Filament-style dark UI served directly by the API:
- Dashboard: player/entity/userdata/titledata counts + recent players
- /admin/players: searchable player list (name/id/steam)
- /admin/players/{id}: full player view — balance/faction/Fortuna cards, inventory
  table, and every UserData key pretty-printed (collapsible)
- /admin/titledata + /admin/titledata/{key}: browse in-memory title data
Restricted to LAN/loopback callers (RemoteIpAddress check) so it is never reachable
from the public internet even though :8443 is port-forwarded.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Prospect.Server.Api/Services/Database/DbUserService.cs

@@ -24,6 +24,12 @@ public class DbUserService : BaseDbService<PlayFabUser>
         return await Collection.Find(user => user.Id == id).FirstOrDefaultAsync();
     }
 
+    // Admin back-office: list every player.
+    public async Task<List<PlayFabUser>> GetAllAsync()
+    {
+        return await Collection.Find(_ => true).ToListAsync();
+    }
+
     // Persist a display-name change (UpdateUserTitleDisplayName). Without this the rename
     // is echoed back to the client but lost on next login.
     public async Task UpdateDisplayNameAsync(string id, string displayName)