Add roles and a user management tab for admins (#180, #179)

Until now every account could do the same, and managing accounts
meant running make-user.php on the server. Accounts now carry a role,
and admins get a tab in the editor to create, rename, re-role, reset
and delete accounts. Both issues share the same server files, so they
land in one commit.

#180 Roles:
- Every account is admin or user. A missing or unknown role counts as
  user, on the server and in the client.
- auth/session and auth/login return {user, role}.
- Auth::requireAdmin() answers everyone else with 403.
- make-user.php takes the role as a third argument. Without it an
  existing account keeps its role, so a password reset from the CLI
  never demotes an admin.
- Admins see and save other users' projects like their own. Saving
  keeps the original owner.

#179 User management:
- The account menu gets "User management" (admins only) and "Plugins"
  (everyone). Both open the same closable tab, accounts on top and
  plugins below. The fixed Plugins tab is gone.
- Per account: Rename, Role, Password (no old password needed) and
  Delete with a confirmation. "New user..." creates one.
- Each account lists its projects with an Open button.
- Delete is refused while the account still owns projects.
- Renaming moves the projects along and ends every session of the
  account. transfer takes the same lock as save.
- On their own row an admin can only set the password. The last admin
  cannot be demoted or deleted. The server enforces both.
- The account rules live in AccountRules.php and accountRules.ts as
  pure functions, so they are testable without a server.

Findings:
- At 1280 px the Delete button reached past the column edge and was
  not clickable. The name column is flexible now, and module 49 checks
  the layout.
- The server lets an admin delete other users' projects, but the
  editor has no button for it yet. Left open in the issue.

Tests:
- ./check.sh: 148 files, 2214 tests, exit 0 (was 147 / 2204).
- New tests/php/accounts.test.php, 51 checks, plain PHP. CI runs it
  as its own step in the gate job, the host has no PHP.
- New e2e module 49 with 18 checks. CI creates the e2e-admin account
  in serve.sh. Modules 14, 38, 46 and the scaffold follow the new tab.
- e2e 1-16,37,38,45,46,49: all passed, 581 checks.
- Counter-checks: owner on save, admin view, default role and self
  delete in PHP fail 7, 5, 5 and 1 checks. Unchecked requireAdmin,
  a wider column and the caller as owner each fail exactly their
  e2e check.
- Check sum 1314 -> 1333 (+1 in 38, +18 in 49), computed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/editor/App.ts

@@ -1,8 +1,9 @@
 import type { Application } from 'pixi.js';
-import type { AuthStore } from '../core/store/AuthStore';
+import type { AuthStore, SignedIn } from '../core/store/AuthStore';
 import { HttpAuthStore } from '../core/store/HttpAuthStore';
 import { HttpFileStore } from '../core/store/HttpFileStore';
 import { HttpProjectStore } from '../core/store/HttpProjectStore';
+import { HttpUsersStore } from '../core/store/HttpUsersStore';
 import type { StoredTexture, UploadedTexture } from '../core/store/TextureStore';
 import { loadPhysics } from '../runtime/physics/engine';
 import { requestRender, type VStack } from '../ui';
@@ -38,14 +39,14 @@ const PIXEL_BASE = '/game-maker/data/pixels';
  * right away when the session from an earlier visit is still good – which is what lets a
  * deployment replace the editor under an open tab without asking for the password again.
  */
-async function signedInUser(app: Application, root: VStack, auth: AuthStore): Promise<string> {
+async function signedInUser(app: Application, root: VStack, auth: AuthStore): Promise<SignedIn> {
   const existing = await auth.session();
   if (existing !== null) return existing;
 
-  let done: (user: string) => void = () => {};
-  const screen = new LoginScreen(auth, (user) => done(user));
+  let done: (account: SignedIn) => void = () => {};
+  const screen = new LoginScreen(auth, (account) => done(account));
   const removeHook = installLoginHook(app, screen);
-  const user = await new Promise<string>((resolve) => {
+  const account = await new Promise<SignedIn>((resolve) => {
     done = resolve;
     root.add(screen, 1);
     root.resize(app.screen.width, app.screen.height);
@@ -59,7 +60,7 @@ async function signedInUser(app: Application, root: VStack, auth: AuthStore): Pr
   // the corner.
   root.resize(0, 0);
   screen.destroy({ children: true });
-  return user;
+  return account;
 }
 
 /**
@@ -87,7 +88,7 @@ export async function startEditor(app: Application, root: VStack): Promise<void>
   installPixelArtPictures();
 
   const openSession = async (): Promise<void> => {
-    const user = await signedInUser(app, root, auth);
+    const { user, role } = await signedInUser(app, root, auth);
     // Who is signed in goes into the window title: the toolbar is crowded enough, and the title is
     // also what tells two tabs on two accounts apart.
     document.title = `Game Maker – ${user}`;
@@ -109,6 +110,8 @@ export async function startEditor(app: Application, root: VStack): Promise<void>
       new HttpFileStore(API_ENDPOINT, 'sounds'),
       {
         user,
+        role,
+        users: new HttpUsersStore(API_ENDPOINT),
         logOut: () =>
           void endSession(editor).catch((error: unknown) => {
             console.error('[auth] Signing out failed:', error);