feat: real account provisioner, fix NixClient auth bypass

- nixpanel-accounts: creates Apache vhost, PHP-FPM pool, PowerDNS
  zone (A/MX/SPF records), home dir structure, default index.html
- nixpanel-api: create_account now calls provisioner after DB insert
- NixClient: replace fake setTimeout login with real JWT API call;
  admin accounts blocked with redirect message; logout clears token
- CHANGELOG updated

Cargo.toml

@@ -3,6 +3,7 @@ resolver = "2"
 members = [
     "nixpanel-common",
     "nixpanel-api",
+    "nixpanel-accounts",
     "nixpanel-services",
     "nixpanel-sysinfo",
 ]