Add login-required user management (admin/user roles, Config->Benutzer)

No self-signup: admins create every account in Config -> Benutzer with a
typed start password; a forced password change gates first use. Session-
cookie auth protects all /api/* routes; /api/users additionally requires
the admin role. See docs/authentication.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/db/migrations/meta/_journal.json

@@ -85,6 +85,13 @@
       "when": 1790531351492,
       "tag": "0011_glossy_norman_osborn",
       "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "6",
+      "when": 1790617581434,
+      "tag": "0012_lively_turbo",
+      "breakpoints": true
     }
   ]
 }