Let session owners reassign their session to another user

Previously a session could only be reassigned to another user via a
manual DB UPDATE. This adds it to the session edit UI for every owner of
a session (not just admins) - the ownership check in HandleUpdate
(existing.UserId == userId) already guarantees the caller owns the
session, so handing over one's own session is safe.

Backend:
- ProfileEndpoint: new GET /api/users returning a minimal user directory
  (userId/username/displayName only) for any logged-in user. The
  admin-gated /api/admin/users stays the source for sensitive fields
  (defaultPath/canUseCli/isAdmin).
- SessionEndpoint.HandleUpdate: validate the target user exists (400 if
  not) and pass allowUserReassign: true to UpdateSession.
- DatabaseService.UpdateSession: new allowUserReassign flag; only then is
  a non-empty userId applied as user_id (empty/null is ignored - a
  session must always have an owner).

Frontend:
- index.html: hidden #sessionOwnerRow with a user picker card in the
  session edit form (existing sessions only).
- cards.js: buildUserCard helper for the picker.
- session-page.js: initSessionUserPicker loads users via apiGetUsers(),
  preselects the current owner, and on an actual owner change asks for
  confirmation (irreversible - the session leaves the user's own list).
- api.js: apiGetUsers() -> /api/users.
- ARCHITECTURE.md: document /api/users.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

wwwroot/js/cards.js

@@ -87,6 +87,35 @@ function buildTelegramBotCard(bot) {
 }
 
 
+// ── User Card Helper ──
+// Erzeugt ein kompaktes .card-Element für einen Benutzer (für den Zuweisungs-Picker).
+function buildUserCard(user) {
+  const card = document.createElement('div');
+  card.className = 'card card-compact';
+
+  const badges = [];
+  if (user.isAdmin) {
+    badges.push('<span class="badge badge-feature"><i class="fa fa-shield"></i> Admin</span>');
+  }
+
+  const metaParts = [];
+  metaParts.push(`<span class="card-meta-item"><i class="fa fa-at"></i> ${esc(user.username)}</span>`);
+
+  const title = user.displayName || user.username;
+  card.innerHTML = `
+    <div class="card-body">
+      <div class="card-title-row">
+        <span class="card-title"><i class="fa fa-user"></i> ${esc(title)}</span>
+        ${badges.join('')}
+      </div>
+      ${metaParts.length ? `<div class="card-meta">${metaParts.join('')}</div>` : ''}
+    </div>
+  `;
+
+  return card;
+}
+
+
 // ── Agent Card Helper ──
 // Erzeugt ein .card-Element für einen Agent (wiederverwendbar für Dashboard + Picker).