feat(identity): simple user and role management for admins #30

Goal

Company admins manage their users in the app – the customer request asks for "eine einfache Benutzer- und Rechteverwaltung"; invite form and seed script alone do not cover it.

Acceptance criteria

• Admins see the users of their own company with role and status
• Admins invite users, change the role (admin / clerk) and deactivate users; every change is audited
• An admin cannot remove the last admin of a company
• Clerks have no access to user management (server-side check, not only hidden UI)

Not part of this task

• SSO, SCIM, custom roles, cross-company administration

Affected areas

• src/features/identity/
• src/app/

Test plan

Security/Privacy affected?

Yes – authorization. Run security-review before ready-for-review.

Epic: #18 · Architecture: docs/decisions/ADR-0001-pilot-architecture.md