feat(api): user management and audit log for admins (M1)

- /admin/users: list with search, role filter and cursor pages; create
  with a one-time temporary password; rename, change role, block;
  reset password; delete
- every change is checked against the role policy, a forbidden field
  rejects the whole patch; the last active admin is locked in the
  transaction and cannot be demoted, blocked or deleted
- role change and blocking revoke access tokens at once; blocking and
  password reset also end all sessions
- /admin/audit: newest-first journal with actor names
- path and query parameter errors are problem+json now

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/i18n/locales/en/errors.json

@@ -21,7 +21,8 @@
     "current_password_required": "Enter your current password",
     "current_password_invalid": "The current password is wrong",
     "bootstrap_not_required": "The administrator credentials have already been changed",
-    "session_not_found": "Session not found"
+    "session_not_found": "Session not found",
+    "forbidden": "You don't have permission to do this"
   },
   "validation": {
     "password_too_short": "The password must be at least {{min}} characters",
@@ -34,6 +35,12 @@
     "locale_unsupported": "This language is not supported",
     "display_name_too_long": "The name must be at most {{max}} characters",
     "ui_prefs_invalid": "Invalid setting value",
-    "client_type_invalid": "Unknown app type"
+    "client_type_invalid": "Unknown app type",
+    "role_invalid": "Unknown role",
+    "cursor_invalid": "The list is outdated, please reload"
+  },
+  "users": {
+    "not_found": "User not found",
+    "last_admin": "The last administrator cannot be demoted, blocked or deleted"
   }
 }