Add roles and a user management tab for admins (#180, #179)

Until now every account could do the same, and managing accounts
meant running make-user.php on the server. Accounts now carry a role,
and admins get a tab in the editor to create, rename, re-role, reset
and delete accounts. Both issues share the same server files, so they
land in one commit.

#180 Roles:
- Every account is admin or user. A missing or unknown role counts as
  user, on the server and in the client.
- auth/session and auth/login return {user, role}.
- Auth::requireAdmin() answers everyone else with 403.
- make-user.php takes the role as a third argument. Without it an
  existing account keeps its role, so a password reset from the CLI
  never demotes an admin.
- Admins see and save other users' projects like their own. Saving
  keeps the original owner.

#179 User management:
- The account menu gets "User management" (admins only) and "Plugins"
  (everyone). Both open the same closable tab, accounts on top and
  plugins below. The fixed Plugins tab is gone.
- Per account: Rename, Role, Password (no old password needed) and
  Delete with a confirmation. "New user..." creates one.
- Each account lists its projects with an Open button.
- Delete is refused while the account still owns projects.
- Renaming moves the projects along and ends every session of the
  account. transfer takes the same lock as save.
- On their own row an admin can only set the password. The last admin
  cannot be demoted or deleted. The server enforces both.
- The account rules live in AccountRules.php and accountRules.ts as
  pure functions, so they are testable without a server.

Findings:
- At 1280 px the Delete button reached past the column edge and was
  not clickable. The name column is flexible now, and module 49 checks
  the layout.
- The server lets an admin delete other users' projects, but the
  editor has no button for it yet. Left open in the issue.

Tests:
- ./check.sh: 148 files, 2214 tests, exit 0 (was 147 / 2204).
- New tests/php/accounts.test.php, 51 checks, plain PHP. CI runs it
  as its own step in the gate job, the host has no PHP.
- New e2e module 49 with 18 checks. CI creates the e2e-admin account
  in serve.sh. Modules 14, 38, 46 and the scaffold follow the new tab.
- e2e 1-16,37,38,45,46,49: all passed, 581 checks.
- Counter-checks: owner on save, admin view, default role and self
  delete in PHP fail 7, 5, 5 and 1 checks. Unchecked requireAdmin,
  a wider column and the caller as owner each fail exactly their
  e2e check.
- Check sum 1314 -> 1333 (+1 in 38, +18 in 49), computed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/e2e/38-plugins.mjs

@@ -45,7 +45,7 @@ export async function plugins(t) {
   check('the plugin tab is in the tab row', at >= 0, JSON.stringify(order));
   check(
     'and it comes after the fixed tabs, ahead of any document',
-    JSON.stringify(order.slice(0, 3)) === JSON.stringify(['scene', 'game', 'plugins']) &&
+    JSON.stringify(order.slice(0, 2)) === JSON.stringify(['scene', 'game']) &&
       order.slice(at + 1).every((tab) => tab === 'list' || tab.startsWith('asset:')),
     JSON.stringify(order),
   );
@@ -163,15 +163,18 @@ export async function plugins(t) {
   await showTab('scene');
   check('switching to another tab hides the board', (await board()).visible === false);
 
-  // 38i. The Plugins tab (#114, #119): the switch belongs to the project, and it works while the
-  //      editor runs.
-  await openTab(t, 'plugins');
+  // 38i. The plugins (#114, #119): the switch belongs to the project, and it works while the
+  //      editor runs. Since #179 they are no fixed tab but reached through the menu, in a tab that
+  //      closes like a document.
+  await t.clickToolbar('menu');
+  const entry = await t.locate('Plugins', true);
+  await t.click(entry.x, entry.y);
   await settle();
   const pane = () => json('__gm.plugins.pane()');
   let rows = await pane();
   const rowOf = (shown) => shown.rows.find((r) => r.file === 'demo-plugin.js');
   check(
-    'the Plugins tab lists the demo plugin as active, with its name and its switch on',
+    'Menu → Plugins opens the list, with the demo plugin active, its name and its switch on',
     rows.visible === true &&
       rowOf(rows)?.status === 'active' &&
       rowOf(rows)?.name === 'Demo plugin' &&
@@ -213,13 +216,13 @@ export async function plugins(t) {
   const listed = await evaluate(
     `fetch('/game-maker/api/index.php?r=plugins').then(async (r) => JSON.stringify(await r.json()))`,
   );
-  const entry = JSON.parse(listed).find((e) => e.file === 'demo-plugin.js');
+  const file = JSON.parse(listed).find((e) => e.file === 'demo-plugin.js');
   check(
     'the project says it is off, while the server still lists the file itself',
     JSON.stringify(await json('__gm.state.project.plugins')) === '[]' &&
-      entry !== undefined &&
-      entry.active === undefined,
-    JSON.stringify({ plugins: await json('__gm.state.project.plugins'), entry }),
+      file !== undefined &&
+      file.active === undefined,
+    JSON.stringify({ plugins: await json('__gm.state.project.plugins'), file }),
   );
 
   // And because it is a change to the project, undo takes it back – plugin, tab and all.
@@ -256,5 +259,15 @@ export async function plugins(t) {
     JSON.stringify({ nodes: titles(shown), assets: await names() }),
   );
   await shot('39-plugins-tab');
-  await showTab('scene');
+  await evaluate("__gm.closeDocument('management')");
+  await settle();
+  check(
+    'the tab closes like a document and leaves the row',
+    !(await json('__gm.tabRow()')).order.includes('management') &&
+      (await json('__gm.tab()')) !== 'management',
+    JSON.stringify({ tab: await json('__gm.tab()'), order: (await json('__gm.tabRow()')).order }),
+  );
+  // The switch is a change to the project; a step that navigates next would otherwise meet the
+  // autosave's "leave the page?" and wait on it.
+  await t.saved();
 }