Give local users their own manager: custom passwords and role reassignment

Move user management out of Settings into its own /users page (nav-gated
to owners), let an owner type a specific password on reset instead of
always generating a random one, and add role reassignment via a new
PUT /auth/users/{id}/role endpoint. Role changes revoke the target's
existing sessions, same as a password reset, so a demoted user can't
keep acting under a stale, higher-privileged session.

web/src/lib/api.ts

@@ -474,6 +474,14 @@ export function resetPassword(id: string, newPassword?: string): Promise<{ passw
 	});
 }
 
+export function setUserRole(id: string, role: string): Promise<LocalUser> {
+	return request(`/auth/users/${id}/role`, {
+		method: 'PUT',
+		credentials: 'include',
+		body: JSON.stringify({ role })
+	});
+}
+
 // --- alerting ---------------------------------------------------------
 
 export type ConditionType = 'threshold' | 'absence';