feat(ip): protect persona 'formula' — secret fields only super_admin sees/edits

IP protection so casual copying yields inferior results:
- SECRET_PERSONA_FIELDS (pains/objections/negotiation_levers/opener/tolerance +
  pain rootCause/resolutionConditions): only super_admin can view/edit them.
- list_personas/get_persona/update_persona/get_group strip these for role=admin (and
  hide sales_kit + pain-fit report from admins too).
- update_persona rejects admin attempts to set secret fields (403).
- PersonaForm hides the 'การขาย' recipe section for non-super-admin (shows locked note);
  auth.isSuperAdmin getter added.
Rebuilt dist. Added test_ip_protection.

frontend/src/store/auth.js

@@ -12,6 +12,9 @@ export const auth = reactive({
   get isAdmin() {
     return this.role === 'admin' || this.role === 'super_admin'
   },
+  get isSuperAdmin() {
+    return this.role === 'super_admin'
+  },
   async load() {
     if (!this.token) return null
     try {