feat: put invite links on hold; single brand header everywhere

feat: make /product internal - lab members, maintainers, and PI only

Refactor admin page to include collapsible sections and enhance invite link management

Four-tier access model: self-governing admin, pre-login access, audit trail

Upload limits: make the byte ceiling configurable and stream-checked

Admin page v1: user roles (lab tier), password resets, failed-run requeue, verification queue

Apply PI decisions: full construct library (rights approved), anon cap 200, drop CRS

Sync platform from lab mainline: dev instance ready to deploy