Add roles and a user management tab for admins (#180, #179)

Until now every account could do the same, and managing accounts
meant running make-user.php on the server. Accounts now carry a role,
and admins get a tab in the editor to create, rename, re-role, reset
and delete accounts. Both issues share the same server files, so they
land in one commit.

#180 Roles:
- Every account is admin or user. A missing or unknown role counts as
  user, on the server and in the client.
- auth/session and auth/login return {user, role}.
- Auth::requireAdmin() answers everyone else with 403.
- make-user.php takes the role as a third argument. Without it an
  existing account keeps its role, so a password reset from the CLI
  never demotes an admin.
- Admins see and save other users' projects like their own. Saving
  keeps the original owner.

#179 User management:
- The account menu gets "User management" (admins only) and "Plugins"
  (everyone). Both open the same closable tab, accounts on top and
  plugins below. The fixed Plugins tab is gone.
- Per account: Rename, Role, Password (no old password needed) and
  Delete with a confirmation. "New user..." creates one.
- Each account lists its projects with an Open button.
- Delete is refused while the account still owns projects.
- Renaming moves the projects along and ends every session of the
  account. transfer takes the same lock as save.
- On their own row an admin can only set the password. The last admin
  cannot be demoted or deleted. The server enforces both.
- The account rules live in AccountRules.php and accountRules.ts as
  pure functions, so they are testable without a server.

Findings:
- At 1280 px the Delete button reached past the column edge and was
  not clickable. The name column is flexible now, and module 49 checks
  the layout.
- The server lets an admin delete other users' projects, but the
  editor has no button for it yet. Left open in the issue.

Tests:
- ./check.sh: 148 files, 2214 tests, exit 0 (was 147 / 2204).
- New tests/php/accounts.test.php, 51 checks, plain PHP. CI runs it
  as its own step in the gate job, the host has no PHP.
- New e2e module 49 with 18 checks. CI creates the e2e-admin account
  in serve.sh. Modules 14, 38, 46 and the scaffold follow the new tab.
- e2e 1-16,37,38,45,46,49: all passed, 581 checks.
- Counter-checks: owner on save, admin view, default role and self
  delete in PHP fail 7, 5, 5 and 1 checks. Unchecked requireAdmin,
  a wider column and the caller as owner each fail exactly their
  e2e check.
- Check sum 1314 -> 1333 (+1 in 38, +18 in 49), computed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/lib/auth.mjs

@@ -10,8 +10,12 @@ import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 export const E2E_USER = 'e2e';
+/** The administrator the user management step signs in as (#179); it owns nothing. */
+export const E2E_ADMIN = 'e2e-admin';
 
-const PASSWORD_FILE = resolve(dirname(fileURLToPath(import.meta.url)), '../../data/e2e-password.txt');
+const DATA = resolve(dirname(fileURLToPath(import.meta.url)), '../../data');
+const PASSWORD_FILE = resolve(DATA, 'e2e-password.txt');
+const ADMIN_PASSWORD_FILE = resolve(DATA, 'e2e-admin-password.txt');
 const COOKIE = 'game_maker_session';
 
 /** One session per server for the whole process; logging in per request would be pointless load. */
@@ -30,24 +34,45 @@ export async function e2ePassword() {
   }
 }
 
-/** `game_maker_session=…` for `Cookie` headers, logging in on first use. */
-export async function sessionCookie(baseUrl) {
-  const cached = cookies.get(baseUrl);
-  if (cached) return cached;
+/** The password of `e2e-admin`, from `GAME_MAKER_E2E_ADMIN_PASSWORD` or `data/e2e-admin-password.txt`. */
+export async function e2eAdminPassword() {
+  const fromEnv = process.env.GAME_MAKER_E2E_ADMIN_PASSWORD;
+  if (fromEnv) return fromEnv;
+  try {
+    return (await readFile(ADMIN_PASSWORD_FILE, 'utf8')).trim();
+  } catch {
+    throw new Error(
+      `no password for the "${E2E_ADMIN}" account: set GAME_MAKER_E2E_ADMIN_PASSWORD or put it in ${ADMIN_PASSWORD_FILE}`,
+    );
+  }
+}
+
+/**
+ * Signs in as anyone and answers with a fresh `game_maker_session=…`, uncached – for a step that
+ * needs a second account beside the tools' own.
+ */
+export async function logIn(baseUrl, username, password) {
   const res = await fetch(`${baseUrl}api/index.php?r=auth/login`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ username: E2E_USER, password: await e2ePassword() }),
+    body: JSON.stringify({ username, password }),
     signal: AbortSignal.timeout(20_000),
   });
   if (!res.ok) {
-    throw new Error(`could not sign in as "${E2E_USER}" at ${baseUrl}: HTTP ${res.status}`);
+    throw new Error(`could not sign in as "${username}" at ${baseUrl}: HTTP ${res.status}`);
   }
   // `getSetCookie` keeps the headers apart; a joined string cannot be split on commas, because a
   // cookie's own Expires date carries one.
   const set = res.headers.getSetCookie().find((c) => c.startsWith(`${COOKIE}=`));
   if (!set) throw new Error(`signing in at ${baseUrl} returned no ${COOKIE} cookie`);
-  const cookie = set.split(';')[0];
+  return set.split(';')[0];
+}
+
+/** `game_maker_session=…` for `Cookie` headers, logging in on first use. */
+export async function sessionCookie(baseUrl) {
+  const cached = cookies.get(baseUrl);
+  if (cached) return cached;
+  const cookie = await logIn(baseUrl, E2E_USER, await e2ePassword());
   cookies.set(baseUrl, cookie);
   return cookie;
 }