[DJAngel973]

Summary

Implements AUTHZ-001 user-administration authorization boundaries.

Changes

• Enforces 403 responses for USER access to user-administration endpoints.
• Prevents ADMIN accounts from deactivating another ADMIN account.
• Preserves USER-only public registration; role input cannot be persisted.
• Adds immutable deactivation audit evidence with actor and target identifiers.
• Maps Spring Security AccessDeniedException to a consistent 403 ApiResponse.
• Updates AUTHZ-001 verification evidence in IMPLEMENTATION-PLAN.md.

Security

• OWASP A01: prevents privilege escalation and unauthorized user administration.
• OWASP A09: records sensitive account-deactivation actions with actor and target UUIDs.
• USER accounts cannot invoke ADMIN-only endpoints.