feat(api): user management and audit log for admins (M1)

- /admin/users: list with search, role filter and cursor pages; create
  with a one-time temporary password; rename, change role, block;
  reset password; delete
- every change is checked against the role policy, a forbidden field
  rejects the whole patch; the last active admin is locked in the
  transaction and cannot be demoted, blocked or deleted
- role change and blocking revoke access tokens at once; blocking and
  password reset also end all sessions
- /admin/audit: newest-first journal with actor names
- path and query parameter errors are problem+json now

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/server/router.go

@@ -57,5 +57,9 @@ func NewRouter(d Deps) http.Handler {
 		RequestErrorHandlerFunc:  httpx.RequestError,
 		ResponseErrorHandlerFunc: httpx.ResponseError(log),
 	})
-	return gen.HandlerWithOptions(strict, gen.ChiServerOptions{BaseRouter: r})
+	return gen.HandlerWithOptions(strict, gen.ChiServerOptions{
+		BaseRouter: r,
+		// Ошибки разбора path- и query-параметров — тоже problem+json, а не текст по умолчанию.
+		ErrorHandlerFunc: httpx.RequestError,
+	})
 }