feat(admin): users and permissions

Sprint 25.

New features/admin/users/ module, net-new /:lang/backoffice/users route +
Dashboard Quick Action.

- users: name, Telegram username, scope (marketplace vs office admin),
  role (inline change), status (active/invited/suspended), last login
- 4 built-in roles (owner/admin/editor/viewer) with flat permission lists
- invitations: email + role + scope form, pending list + revoke (no email
  actually sends - local record only)
- passwordless login confirmed already real (AdminAuthService Telegram QR,
  docs/BACKEND.md item 1) - linked, not reimplemented
- per-user mock session list (device/IP/last-active, revoke) - flagged as
  mock since the real AdminAuthService only ever tracks the current
  browser's session
- per-user audit log dialog (role/status changes), same pattern as
  Sprint 24's per-transaction audit, intentionally separate from the
  system-wide log planned for Sprint 26

docs/ADMIN.md + docs/BACKEND.md (new item 14) updated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/ADMIN.md

@@ -335,6 +335,40 @@ between the two mock feature areas.
 - Wired into `/​:lang/backoffice/transactions`, replacing the coming-soon
   placeholder.
 
+## Sprint 25 - Users & Roles (mock/local)
+
+`features/admin/users/`. Single consolidated page (`admin-users-page`) at
+`/​:lang/backoffice/users` - not previously in the Quick Actions list or
+routes at all, this is a net-new admin section.
+
+- **Users**: name, Telegram username, `scope` (`marketplace` vs `office`
+  admin - distinguishes tenant-level owners/admins from internal staff),
+  role, status (`active`/`invited`/`suspended`), last login. Role change is
+  an inline `<select>`; suspend/reactivate is confirm-gated for suspend
+  only.
+- **Roles/permissions**: 4 built-in roles (`owner`/`admin`/`editor`/`viewer`)
+  with a flat permission-string list (`products.manage`, `*` for owner,
+  etc.) - a real permission catalog and custom-role creation don't exist,
+  intentionally scoped down to what's needed to demonstrate the model.
+- **Invitations**: email + role + scope form, pending list with revoke.
+  No email actually sends - `AdminUsersLocalGateway.inviteUser()` only
+  creates the local record.
+- **Passwordless login**: already existed before this sprint -
+  `AdminAuthService`'s Telegram QR flow (`docs/ADMIN.md`'s existing admin
+  login section, `docs/BACKEND.md` item 1). This sprint's Users page links
+  to it via a hint, doesn't reimplement it.
+- **Session manager / device manager**: per-user session list (device, IP,
+  last active, current-session badge) with per-session revoke, mocked
+  (`AdminUsersLocalGateway.loadSessions()` fabricates 2 sessions per user
+  on first view) - the real `AdminAuthService`/session-cookie flow only
+  ever tracks the *current* browser's session, so multi-device session
+  listing has no real backend counterpart yet (see `docs/BACKEND.md` item 1).
+- **Audit**: per-user audit log (role/status changes), same dialog pattern
+  as Sprint 24's per-transaction audit - not the system-wide security/audit
+  log planned for Sprint 26.
+- Wired into `AdminDashboardFacade`'s Quick Actions list (`dashboard.actionUsers`
+  -> `/​:lang/backoffice/users`).
+
 ## Known gaps / backend needs
 
 - **Dashboard metrics endpoint.** Categories/Products counts are computed

docs/BACKEND.md

@@ -152,6 +152,14 @@ Plus, if authenticated history/wishlist/compare/saved-searches sync is wanted: `
 
 **Frontend files:** implement `AdminTransactionsApiGateway` against `AdminTransactionsGateway` (`services/admin-transactions-gateway.interface.ts`) and rebind via an injection token.
 
+## 14. Users, roles & permissions (Sprint 25, mock/local)
+
+**Current behavior:** `features/admin/users/` (users, built-in roles, invitations, per-user mock sessions, per-user audit log) against `AdminUsersLocalGateway` — fully synthetic, no backend. Passwordless login itself is real (`AdminAuthService`, Telegram QR, `docs/BACKEND.md` item 1) — only the roles/permissions/invitations/multi-session-listing layer on top is mocked.
+
+**Needed:** a real user/role domain tied to the eventual server-side admin-authorization enforcement in item 1 — role assignment, a real permission catalog, invitation emails, and genuine multi-device session listing (the current `AdminAuthService` only ever knows about the current browser's session).
+
+**Frontend files:** implement `AdminUsersApiGateway` against `AdminUsersGateway` (`services/admin-users-gateway.interface.ts`) and rebind via an injection token.
+
 ## Known reliability issues
 
 ### Production 502/504 Bad Gateway on refresh / back-navigation

docs/SPRINT-PLAN.md

@@ -52,9 +52,11 @@ Notify user: **from Sprint 20 (Categories) once product↔category link + admin
 - [x] `docs/ADMIN.md` (new Sprint 24 section), `docs/BACKEND.md` item 13 added
 - Commit: `feat(admin): transaction management`
 
-## Sprint 25 — Users & Roles
-- [ ] Users/roles/permissions models (local), marketplace vs office admin distinction
-- [ ] Invitations, passwordless login (reuse existing Telegram QR pattern), session/device manager, audit trail
+## Sprint 25 — Users & Roles ✅ done
+- [x] Users/roles/permissions models (local, 4 built-in roles), marketplace vs office admin distinction
+- [x] Invitations, passwordless login confirmed already real (Telegram QR, AdminAuthService — linked not reimplemented), session/device manager (mocked), per-user audit trail
+- [x] Wired into Dashboard Quick Actions + new `/​:lang/backoffice/users` route
+- [x] `docs/ADMIN.md` (new Sprint 25 section), `docs/BACKEND.md` item 14 added
 - Commit: `feat(admin): users and permissions`
 
 ## Sprint 26 — Monitoring