feat(api): user management and audit log for admins (M1)

- /admin/users: list with search, role filter and cursor pages; create
  with a one-time temporary password; rename, change role, block;
  reset password; delete
- every change is checked against the role policy, a forbidden field
  rejects the whole patch; the last active admin is locked in the
  transaction and cannot be demoted, blocked or deleted
- role change and blocking revoke access tokens at once; blocking and
  password reset also end all sessions
- /admin/audit: newest-first journal with actor names
- path and query parameter errors are problem+json now

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/auth/model.go

@@ -95,6 +95,18 @@ type Principal struct {
 	MustChangeCredentials bool
 }
 
+// AuditRecord — прочитанная запись audit_log с логином автора.
+type AuditRecord struct {
+	ID            uuid.UUID
+	ActorID       *uuid.UUID
+	ActorUsername *string
+	Action        string
+	TargetType    *string
+	TargetID      *uuid.UUID
+	Payload       map[string]any
+	CreatedAt     time.Time
+}
+
 // AuditEntry — запись audit_log.
 type AuditEntry struct {
 	ActorID    *uuid.UUID