MIKE-05: User Administration - admin-only user management

From the PR description

MIKE-05: User Administration

Add admin-only user management to Mike: list users, create/invite, change roles, disable/enable, reset password, revoke sessions, audit log.

Changes

• Migration: user_profiles gains role, status, last_login_at, created_by, disabled_at, disabled_by; new admin_audit_log table
• Backend: requireAdmin middleware; /admin/users CRUD endpoints
• Frontend: Settings > User Administration page (admin-only tab); public signup page replaced with redirect
• Tests: 5 new tests for requireAdmin middleware

Endpoints

• GET /admin/users - list all users
• POST /admin/users - create user with temp password
• PATCH /admin/users/:id/role - change role
• PATCH /admin/users/:id/disable - disable user
• PATCH /admin/users/:id/enable - enable user
• POST /admin/users/:id/reset-password - reset password
• POST /admin/users/:id/revoke-sessions - revoke sessions
• GET /admin/users/:id/audit - audit log

Acceptance

• 245 tests green (160 backend + 85 frontend)
• Typecheck OK
• Lint OK
• Builds OK