Add roles and a user management tab for admins (#180, #179)

Until now every account could do the same, and managing accounts
meant running make-user.php on the server. Accounts now carry a role,
and admins get a tab in the editor to create, rename, re-role, reset
and delete accounts. Both issues share the same server files, so they
land in one commit.

#180 Roles:
- Every account is admin or user. A missing or unknown role counts as
  user, on the server and in the client.
- auth/session and auth/login return {user, role}.
- Auth::requireAdmin() answers everyone else with 403.
- make-user.php takes the role as a third argument. Without it an
  existing account keeps its role, so a password reset from the CLI
  never demotes an admin.
- Admins see and save other users' projects like their own. Saving
  keeps the original owner.

#179 User management:
- The account menu gets "User management" (admins only) and "Plugins"
  (everyone). Both open the same closable tab, accounts on top and
  plugins below. The fixed Plugins tab is gone.
- Per account: Rename, Role, Password (no old password needed) and
  Delete with a confirmation. "New user..." creates one.
- Each account lists its projects with an Open button.
- Delete is refused while the account still owns projects.
- Renaming moves the projects along and ends every session of the
  account. transfer takes the same lock as save.
- On their own row an admin can only set the password. The last admin
  cannot be demoted or deleted. The server enforces both.
- The account rules live in AccountRules.php and accountRules.ts as
  pure functions, so they are testable without a server.

Findings:
- At 1280 px the Delete button reached past the column edge and was
  not clickable. The name column is flexible now, and module 49 checks
  the layout.
- The server lets an admin delete other users' projects, but the
  editor has no button for it yet. Left open in the issue.

Tests:
- ./check.sh: 148 files, 2214 tests, exit 0 (was 147 / 2204).
- New tests/php/accounts.test.php, 51 checks, plain PHP. CI runs it
  as its own step in the gate job, the host has no PHP.
- New e2e module 49 with 18 checks. CI creates the e2e-admin account
  in serve.sh. Modules 14, 38, 46 and the scaffold follow the new tab.
- e2e 1-16,37,38,45,46,49: all passed, 581 checks.
- Counter-checks: owner on save, admin view, default role and self
  delete in PHP fail 7, 5, 5 and 1 checks. Unchecked requireAdmin,
  a wider column and the caller as owner each fail exactly their
  e2e check.
- Check sum 1314 -> 1333 (+1 in 38, +18 in 49), computed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/core/store/AuthStore.ts

@@ -2,11 +2,20 @@
  * Signing in and out. The token itself never reaches this code: the server keeps the session and
  * hands the browser a cookie, so all that travels here is the name behind it.
  */
+/** `admin` may manage the accounts and open every project (#180, #179); anything else is a `user`. */
+export type Role = 'admin' | 'user';
+
+/** Who is signed in, and what they may do – the server decides, this only says what to offer. */
+export interface SignedIn {
+  user: string;
+  role: Role;
+}
+
 export interface AuthStore {
   /** The signed-in user, or null while nobody is. */
-  session(): Promise<string | null>;
-  /** The user name on success; a rejected promise when the pair is wrong. */
-  logIn(username: string, password: string): Promise<string>;
+  session(): Promise<SignedIn | null>;
+  /** Who signed in on success; a rejected promise when the pair is wrong. */
+  logIn(username: string, password: string): Promise<SignedIn>;
   logOut(): Promise<void>;
   /**
    * Replaces the password of the signed-in account. The current one has to come along even though
@@ -16,6 +25,11 @@ export interface AuthStore {
   changePassword(currentPassword: string, newPassword: string): Promise<void>;
 }
 
+/** Anything the server did not call `admin` is a `user`: the weaker reading is the safe one. */
+export function roleOf(value: unknown): Role {
+  return value === 'admin' ? 'admin' : 'user';
+}
+
 /** Thrown for a wrong user name or password, as opposed to a server that is not there. */
 export class WrongCredentialsError extends Error {
   constructor(message = 'Wrong user name or password') {

src/core/store/HttpAuthStore.ts

@@ -1,16 +1,20 @@
-import { type AuthStore, WrongCredentialsError } from './AuthStore';
+import { type AuthStore, roleOf, type SignedIn, WrongCredentialsError } from './AuthStore';
 import { apiRequest } from './http';
 
 export class HttpAuthStore implements AuthStore {
   constructor(private readonly endpoint: string) {}
 
-  async session(): Promise<string | null> {
-    const body = await apiRequest<{ user: string | null }>(this.endpoint, 'GET', 'auth/session');
-    return body.user;
+  async session(): Promise<SignedIn | null> {
+    const body = await apiRequest<{ user: string | null; role?: unknown }>(
+      this.endpoint,
+      'GET',
+      'auth/session',
+    );
+    return body.user === null ? null : { user: body.user, role: roleOf(body.role) };
   }
 
-  async logIn(username: string, password: string): Promise<string> {
-    const body = await apiRequest<{ user: string }>(
+  async logIn(username: string, password: string): Promise<SignedIn> {
+    const body = await apiRequest<{ user: string; role?: unknown }>(
       this.endpoint,
       'POST',
       'auth/login',
@@ -23,7 +27,7 @@ export class HttpAuthStore implements AuthStore {
       (status, data) =>
         status === 401 ? new WrongCredentialsError((data as { error?: string } | null)?.error) : undefined,
     );
-    return body.user;
+    return { user: body.user, role: roleOf(body.role) };
   }
 
   async logOut(): Promise<void> {

src/core/store/HttpUsersStore.ts

@@ -0,0 +1,34 @@
+import { type Role, roleOf } from './AuthStore';
+import { apiRequest } from './http';
+import type { Account, AccountChange, UsersStore } from './UsersStore';
+
+/** A refusal of the API (4xx with an `{error}`) as its bare sentence, without route and status around it. */
+function refusal(status: number, data: unknown): Error | undefined {
+  const message = (data as { error?: unknown } | null)?.error;
+  return status >= 400 && status < 500 && typeof message === 'string' ? new Error(message) : undefined;
+}
+
+export class HttpUsersStore implements UsersStore {
+  constructor(private readonly endpoint: string) {}
+
+  async list(): Promise<Account[]> {
+    const rows = await apiRequest<Account[]>(this.endpoint, 'GET', 'users', {}, refusal);
+    return rows.map((row) => ({ ...row, role: roleOf(row.role) }));
+  }
+
+  async create(username: string, password: string, role: Role): Promise<void> {
+    await apiRequest(this.endpoint, 'POST', 'users', this.json({ username, password, role }), refusal);
+  }
+
+  async update(username: string, change: AccountChange): Promise<void> {
+    await apiRequest(this.endpoint, 'PATCH', `users/${username}`, this.json(change), refusal);
+  }
+
+  async remove(username: string): Promise<void> {
+    await apiRequest<void>(this.endpoint, 'DELETE', `users/${username}`, {}, refusal);
+  }
+
+  private json(body: object): { headers: Record<string, string>; body: string } {
+    return { headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) };
+  }
+}

src/core/store/UsersStore.ts

@@ -0,0 +1,36 @@
+import type { Role } from './AuthStore';
+
+/** A project as the user management lists it under its owner. */
+export interface OwnedProject {
+  id: string;
+  name: string;
+  updatedAt: string;
+}
+
+/** One account as an administrator sees it – never the password. */
+export interface Account {
+  username: string;
+  role: Role;
+  /** ISO date; empty for the accounts from before #179, which were made without one. */
+  createdAt: string;
+  projects: OwnedProject[];
+}
+
+/** What an administrator changes about an account in one go; a field left out stays. */
+export interface AccountChange {
+  username?: string;
+  role?: Role;
+  password?: string;
+}
+
+/**
+ * The accounts, for administrators only (#179). The server checks the role on every call: a user
+ * who got hold of this would get 403s, nothing else. A refusal rejects with the server's own
+ * sentence as the message, so a dialog can show it as it stands.
+ */
+export interface UsersStore {
+  list(): Promise<Account[]>;
+  create(username: string, password: string, role: Role): Promise<void>;
+  update(username: string, change: AccountChange): Promise<void>;
+  remove(username: string): Promise<void>;
+}