Add role management validation to prevent removal of the last admin

- Introduced a new error, `CannotRemoveLastAdmin`, to handle attempts to downgrade the last admin user in the system.
- Updated `RoleService` to check the number of admin users before allowing a role change that would remove the last admin.
- Enhanced unit tests to verify the new behavior, ensuring that attempts to downgrade the last admin correctly propagate the failure.
- Updated API documentation to reflect the new validation logic and its implications for role management.

backend/tests/PnvPanel.Application.Tests/Admin/Support/CloseTicketCommandHandlerTests.cs

@@ -0,0 +1,68 @@
+using NSubstitute;
+using PnvPanel.Application.Admin.Support;
+using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Tests.TestSupport;
+using PnvPanel.Domain.Support;
+using Xunit;
+
+namespace PnvPanel.Application.Tests.Admin.Support;
+
+public class CloseTicketCommandHandlerTests
+{
+    private readonly IRealtimeNotifier _notifier = Substitute.For<IRealtimeNotifier>();
+    private readonly ITelegramNotifier _telegramNotifier = Substitute.For<ITelegramNotifier>();
+
+    [Fact]
+    public async Task Handle_ClosesOpenTicket()
+    {
+        using var dbContext = InMemoryDbContextFactory.Create();
+        var userId = Guid.NewGuid();
+        var ticket = SupportTicket.CreateBugReport(userId);
+        dbContext.SupportTickets.Add(ticket);
+        await dbContext.SaveChangesAsync(CancellationToken.None);
+
+        var currentUser = FakeCurrentUser.Authenticated(Guid.NewGuid(), "admin");
+        var handler = new CloseTicketCommandHandler(
+            dbContext,
+            _notifier,
+            _telegramNotifier,
+            currentUser
+        );
+
+        var result = await handler.Handle(
+            new CloseTicketCommand(ticket.Id),
+            CancellationToken.None
+        );
+
+        Assert.True(result.IsSuccess);
+        Assert.Equal(TicketStatus.Closed, ticket.Status);
+    }
+
+    [Fact]
+    public async Task Handle_WhenTicketIsOwnedByAdmin_StillCloses()
+    {
+        // Закрыть свой же тикет можно — Close не меняет роль, риска нет (иначе одинокий админ не
+        // смог бы почистить случайно созданный тикет никогда).
+        using var dbContext = InMemoryDbContextFactory.Create();
+        var adminId = Guid.NewGuid();
+        var ticket = SupportTicket.CreateBugReport(adminId);
+        dbContext.SupportTickets.Add(ticket);
+        await dbContext.SaveChangesAsync(CancellationToken.None);
+
+        var currentUser = FakeCurrentUser.Authenticated(adminId, "admin");
+        var handler = new CloseTicketCommandHandler(
+            dbContext,
+            _notifier,
+            _telegramNotifier,
+            currentUser
+        );
+
+        var result = await handler.Handle(
+            new CloseTicketCommand(ticket.Id),
+            CancellationToken.None
+        );
+
+        Assert.True(result.IsSuccess);
+        Assert.Equal(TicketStatus.Closed, ticket.Status);
+    }
+}