Add roles and a user management tab for admins (#180, #179)

Until now every account could do the same, and managing accounts
meant running make-user.php on the server. Accounts now carry a role,
and admins get a tab in the editor to create, rename, re-role, reset
and delete accounts. Both issues share the same server files, so they
land in one commit.

#180 Roles:
- Every account is admin or user. A missing or unknown role counts as
  user, on the server and in the client.
- auth/session and auth/login return {user, role}.
- Auth::requireAdmin() answers everyone else with 403.
- make-user.php takes the role as a third argument. Without it an
  existing account keeps its role, so a password reset from the CLI
  never demotes an admin.
- Admins see and save other users' projects like their own. Saving
  keeps the original owner.

#179 User management:
- The account menu gets "User management" (admins only) and "Plugins"
  (everyone). Both open the same closable tab, accounts on top and
  plugins below. The fixed Plugins tab is gone.
- Per account: Rename, Role, Password (no old password needed) and
  Delete with a confirmation. "New user..." creates one.
- Each account lists its projects with an Open button.
- Delete is refused while the account still owns projects.
- Renaming moves the projects along and ends every session of the
  account. transfer takes the same lock as save.
- On their own row an admin can only set the password. The last admin
  cannot be demoted or deleted. The server enforces both.
- The account rules live in AccountRules.php and accountRules.ts as
  pure functions, so they are testable without a server.

Findings:
- At 1280 px the Delete button reached past the column edge and was
  not clickable. The name column is flexible now, and module 49 checks
  the layout.
- The server lets an admin delete other users' projects, but the
  editor has no button for it yet. Left open in the issue.

Tests:
- ./check.sh: 148 files, 2214 tests, exit 0 (was 147 / 2204).
- New tests/php/accounts.test.php, 51 checks, plain PHP. CI runs it
  as its own step in the gate job, the host has no PHP.
- New e2e module 49 with 18 checks. CI creates the e2e-admin account
  in serve.sh. Modules 14, 38, 46 and the scaffold follow the new tab.
- e2e 1-16,37,38,45,46,49: all passed, 581 checks.
- Counter-checks: owner on save, admin view, default role and self
  delete in PHP fail 7, 5, 5 and 1 checks. Unchecked requireAdmin,
  a wider column and the caller as owner each fail exactly their
  e2e check.
- Check sum 1314 -> 1333 (+1 in 38, +18 in 49), computed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/lib/UserStore.php

@@ -2,11 +2,15 @@
 declare(strict_types=1);
 
 /**
- * The accounts, as one JSON file: `data/users.json` holding `{username, password}` per user,
- * where `password` is a hash from `password_hash` – the plain one is never stored.
+ * The accounts, as one JSON file: `data/users.json` holding `{username, password, role, createdAt}`
+ * per user, where `password` is a hash from `password_hash` – the plain one is never stored.
  *
- * Accounts are made from the command line (`tools/make-user.php`), not through the API: signing
- * up is a follow-up of its own, and until it exists nobody may create an account over the wire.
+ * An entry without `role` is a `user` (#180): the weaker of the two is what a missing field means,
+ * so a hand-written file never hands out rights by accident. `createdAt` is missing on the accounts
+ * from before #179 and stays empty for them.
+ *
+ * Accounts are made from the command line (`tools/make-user.php`) or by an administrator through
+ * the `users` routes (#179); nobody can sign up over the wire.
  */
 final class UserStore
 {
@@ -17,6 +21,8 @@ final class UserStore
      */
     public const MIN_PASSWORD_LENGTH = 8;
 
+    public const ROLES = ['admin', 'user'];
+
     public function __construct(private readonly string $file) {}
 
     public static function isValidName(string $name): bool
@@ -29,6 +35,11 @@ final class UserStore
         return strlen($password) >= self::MIN_PASSWORD_LENGTH;
     }
 
+    public static function isValidRole(string $role): bool
+    {
+        return in_array($role, self::ROLES, true);
+    }
+
     /** The name as stored, or null when the pair does not match an account. */
     public function verify(string $username, string $password): ?string
     {
@@ -44,30 +55,119 @@ final class UserStore
         return $this->find($username) !== null;
     }
 
-    /** @return list<string> */
-    public function names(): array
+    /** `user` for an account that does not exist, the same as for one without a role. */
+    public function role(string $username): string
     {
-        return array_map(static fn(array $u): string => $u['username'], $this->all());
+        return $this->find($username)['role'] ?? 'user';
     }
 
-    /** Adds the account or replaces the password of one that is already there. */
-    public function put(string $username, string $password): void
+    /**
+     * Every account as the API may show it – never the hash.
+     *
+     * @return list<array{username:string,role:string,createdAt:string}>
+     */
+    public function accounts(): array
+    {
+        return array_map(
+            static fn(array $u): array => [
+                'username' => $u['username'],
+                'role' => $u['role'],
+                'createdAt' => $u['createdAt'],
+            ],
+            $this->all(),
+        );
+    }
+
+    public function adminCount(): int
+    {
+        return count(array_filter($this->all(), static fn(array $u): bool => $u['role'] === 'admin'));
+    }
+
+    /**
+     * Adds the account or replaces the password of one that is already there. Without `$role` a new
+     * account is a `user` and an existing one keeps what it has, so resetting a password from the
+     * command line never demotes an administrator.
+     */
+    public function put(string $username, string $password, ?string $role = null): void
     {
         if (!self::isValidName($username)) {
             throw new InvalidArgumentException("Invalid user name: {$username}");
         }
-        $users = array_values(
-            array_filter(
-                $this->all(),
-                static fn(array $u): bool => strcasecmp($u['username'], $username) !== 0,
-            ),
-        );
-        $users[] = ['username' => $username, 'password' => password_hash($password, PASSWORD_DEFAULT)];
-        usort($users, static fn(array $a, array $b): int => strcmp($a['username'], $b['username']));
+        if ($role !== null && !self::isValidRole($role)) {
+            throw new InvalidArgumentException("Invalid role: {$role}");
+        }
+        $existing = $this->find($username);
+        $users = $this->without($username);
+        $users[] = [
+            'username' => $existing['username'] ?? $username,
+            'password' => password_hash($password, PASSWORD_DEFAULT),
+            'role' => $role ?? $existing['role'] ?? 'user',
+            'createdAt' => $existing !== null ? $existing['createdAt'] : gmdate('c'),
+        ];
         $this->write($users);
     }
 
-    /** @return array{username:string,password:string}|null */
+    /** @return bool False when there is no such account. */
+    public function setRole(string $username, string $role): bool
+    {
+        if (!self::isValidRole($role)) {
+            throw new InvalidArgumentException("Invalid role: {$role}");
+        }
+        return $this->change($username, static fn(array $u): array => ['role' => $role] + $u);
+    }
+
+    /**
+     * Gives an account a new name. Only the name: the projects that carry the old one as `owner`
+     * and the sessions that do are the caller's to move (see `Store::transfer`).
+     *
+     * @return bool False when there is no such account.
+     * @throws InvalidArgumentException when the new name is invalid or taken by another account.
+     */
+    public function rename(string $from, string $to): bool
+    {
+        if (!self::isValidName($to)) {
+            throw new InvalidArgumentException("Invalid user name: {$to}");
+        }
+        $other = $this->find($to);
+        // Only a change of case is the same account; any other match is somebody else's name.
+        if ($other !== null && strcasecmp($other['username'], $from) !== 0) {
+            throw new InvalidArgumentException("The name {$to} is taken");
+        }
+        return $this->change($from, static fn(array $u): array => ['username' => $to] + $u);
+    }
+
+    /** @return bool False when there is no such account. */
+    public function remove(string $username): bool
+    {
+        if ($this->find($username) === null) {
+            return false;
+        }
+        $this->write($this->without($username));
+        return true;
+    }
+
+    /** @param callable(array):array $edit */
+    private function change(string $username, callable $edit): bool
+    {
+        $user = $this->find($username);
+        if ($user === null) {
+            return false;
+        }
+        $users = $this->without($username);
+        $users[] = $edit($user);
+        $this->write($users);
+        return true;
+    }
+
+    /** @return list<array{username:string,password:string,role:string,createdAt:string}> */
+    private function without(string $username): array
+    {
+        return array_values(
+            array_filter($this->all(), static fn(array $u): bool => strcasecmp($u['username'], $username) !== 0),
+        );
+    }
+
+    /** @return array{username:string,password:string,role:string,createdAt:string}|null */
     private function find(string $username): ?array
     {
         foreach ($this->all() as $user) {
@@ -78,7 +178,7 @@ final class UserStore
         return null;
     }
 
-    /** @return list<array{username:string,password:string}> */
+    /** @return list<array{username:string,password:string,role:string,createdAt:string}> */
     private function all(): array
     {
         if (!is_file($this->file)) {
@@ -92,15 +192,22 @@ final class UserStore
         $users = [];
         foreach ($data['users'] as $user) {
             if (is_array($user) && is_string($user['username'] ?? null) && is_string($user['password'] ?? null)) {
-                $users[] = ['username' => $user['username'], 'password' => $user['password']];
+                $role = $user['role'] ?? null;
+                $users[] = [
+                    'username' => $user['username'],
+                    'password' => $user['password'],
+                    'role' => is_string($role) && self::isValidRole($role) ? $role : 'user',
+                    'createdAt' => is_string($user['createdAt'] ?? null) ? $user['createdAt'] : '',
+                ];
             }
         }
         return $users;
     }
 
-    /** @param list<array{username:string,password:string}> $users */
+    /** @param list<array{username:string,password:string,role:string,createdAt:string}> $users */
     private function write(array $users): void
     {
+        usort($users, static fn(array $a, array $b): int => strcmp($a['username'], $b['username']));
         $dir = dirname($this->file);
         if (!is_dir($dir) && !mkdir($dir, 0775, true) && !is_dir($dir)) {
             throw new RuntimeException("Cannot create data directory {$dir}");