Add login-required user management (admin/user roles, Config->Benutzer)

No self-signup: admins create every account in Config -> Benutzer with a
typed start password; a forced password change gates first use. Session-
cookie auth protects all /api/* routes; /api/users additionally requires
the admin role. See docs/authentication.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/server/routes/auth.routes.ts

@@ -0,0 +1,16 @@
+import { Router } from "express";
+import {
+  changePassword,
+  getAuthStatus,
+  getMe,
+  login,
+  logout,
+} from "../controllers/auth.controller.js";
+
+export const authRouter = Router();
+
+authRouter.get("/status", getAuthStatus);
+authRouter.post("/login", login);
+authRouter.get("/me", getMe);
+authRouter.post("/change-password", changePassword);
+authRouter.post("/logout", logout);

src/server/routes/user.routes.ts

@@ -0,0 +1,16 @@
+import { Router } from "express";
+import { requireRole } from "../auth/auth.middleware.js";
+import {
+  createUser,
+  listUsers,
+  resetUserPassword,
+  updateUser,
+} from "../controllers/user.controller.js";
+
+export const userRouter = Router();
+
+userRouter.use(requireRole("admin"));
+userRouter.get("/", listUsers);
+userRouter.post("/", createUser);
+userRouter.patch("/:userId", updateUser);
+userRouter.post("/:userId/reset-password", resetUserPassword);