feat(admin): console user management with user types

[jogunjobi]

Second of two PRs (the first, #59, added the viewer role). Feedback from evaluators: after deployment an administrator could not add more console users; the only way was SQL.

What it adds

• A Console Users page (sidebar, administrators only) and /api/admin-users: list, add, edit, reset password, disable, enable, delete.
• User types: Administrator (owner), Read-write (security_admin), Read-only (viewer), Custom (any of the fine-grained roles; never owner/admin).
• First password: generated (20 chars without look-alikes, about 115 bits), shown once with no-store caching, and must be changed at first sign-in. Reset does the same. With SSO on, non-administrators sign in with SSO (subject required, no password); administrators still get a break-glass password.
• Guards: an administrator cannot change, disable, reset or delete their own account here; the last enabled administrator cannot be demoted, disabled or deleted; delete only after disable. Changes are serialised with an advisory lock.
• Sessions: role, enabled and password changes end the user's sessions on their next request (existing authorization_version trigger).
• Audit: admin_user.create|update|reset_password|disable|enable|delete, strict (fails closed), before/after summaries with no password, hash or SSO subject.
• Only owner/admin reach the new routes (empty rules at the top of both RBAC tables). Rules live in admin/admin_users.py, shared by API and pages. No migration.

Tests

• Unit: 35 service tests (types, validation, password policy, every guard, no secrets in output or audit), 16 route tests through real sessions (RBAC for security_admin/viewer/auditor/policy_admin, disable ends an open session, reveal shown once, errors in place).
• e2e test_admin_user_management.py (4 tests): read-only user signs in with the temporary password, is held until they change it, reads pages, is refused writes and console users; read-write user can write but not manage users or map console SSO subjects; disable ends the session; delete needs disable; reset forces a new choice.
• Browser certification covers the list and form pages. Mutations caught: last-administrator guard, self guard, admin-users rule opened to security_admin, custom roles unchecked.
• Local: lint, type, 3447 unit/dashboard/integration, full e2e 254 passed, browser 22 passed, docs-check.

Docs: rewritten Manage admin users guide (types, one-time password, reset, disable vs delete, guards, SSO, SQL recovery appendix), admin-access link, regenerated admin-roles/admin-api/OpenAPI, CHANGELOG.

[jogunjobi]

Landed on main as 803ef07 (squashed; change identical to the PR diff).