Initial commit: base slice (auth, roles, users, admin) scaffold

Backend: .NET 10 Clean Architecture + LiteCqrs.Net + EF Core/PostgreSQL +
Identity/JWT. Frontend: React 19 + Vite + TanStack Query/Router + Tailwind v4
with a retro CRT theme. Docker/compose deployment mirroring PnvPanel's
conventions, scoped down to the current base feature set.

backend/tests/TeleWave.Application.Tests/Admin/Roles/ChangeUserRoleCommandHandlerTests.cs

@@ -0,0 +1,28 @@
+using NSubstitute;
+using TeleWave.Application.Admin.Roles.ChangeUserRole;
+using TeleWave.Application.Common.Interfaces;
+using TeleWave.Application.Common.Models;
+using Xunit;
+
+namespace TeleWave.Application.Tests.Admin.Roles;
+
+public class ChangeUserRoleCommandHandlerTests
+{
+    private readonly IRoleService _roleService = Substitute.For<IRoleService>();
+
+    [Fact]
+    public async Task Handle_DelegatesToRoleService()
+    {
+        var userId = Guid.NewGuid();
+        var roleId = Guid.NewGuid();
+        _roleService
+            .ChangeUserRoleAsync(userId, roleId, Arg.Any<CancellationToken>())
+            .Returns(Result.Success());
+
+        var handler = new ChangeUserRoleCommandHandler(_roleService);
+        var result = await handler.Handle(new ChangeUserRoleCommand(userId, roleId), CancellationToken.None);
+
+        Assert.True(result.IsSuccess);
+        await _roleService.Received(1).ChangeUserRoleAsync(userId, roleId, Arg.Any<CancellationToken>());
+    }
+}