feat(admin): users and permissions

Sprint 25.

New features/admin/users/ module, net-new /:lang/backoffice/users route +
Dashboard Quick Action.

- users: name, Telegram username, scope (marketplace vs office admin),
  role (inline change), status (active/invited/suspended), last login
- 4 built-in roles (owner/admin/editor/viewer) with flat permission lists
- invitations: email + role + scope form, pending list + revoke (no email
  actually sends - local record only)
- passwordless login confirmed already real (AdminAuthService Telegram QR,
  docs/BACKEND.md item 1) - linked, not reimplemented
- per-user mock session list (device/IP/last-active, revoke) - flagged as
  mock since the real AdminAuthService only ever tracks the current
  browser's session
- per-user audit log dialog (role/status changes), same pattern as
  Sprint 24's per-transaction audit, intentionally separate from the
  system-wide log planned for Sprint 26

docs/ADMIN.md + docs/BACKEND.md (new item 14) updated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/features/admin/users/facade/admin-users.facade.ts

@@ -0,0 +1,73 @@
+import { Injectable, inject, signal } from '@angular/core';
+import { take } from 'rxjs/operators';
+import { AdminInvitation, AdminRole, AdminSession, AdminUser, AdminUserAuditEntry, AdminUserScope, AdminUserStatus } from '../models/admin-user.model';
+import { AdminUsersLocalGateway } from '../services/admin-users-local.gateway';
+
+@Injectable({ providedIn: 'root' })
+export class AdminUsersFacade {
+  private readonly gateway = inject(AdminUsersLocalGateway);
+
+  readonly users = signal<AdminUser[]>([]);
+  readonly roles = signal<AdminRole[]>([]);
+  readonly invitations = signal<AdminInvitation[]>([]);
+  readonly loading = signal(false);
+  readonly sessionsTarget = signal<AdminUser | null>(null);
+  readonly sessions = signal<AdminSession[]>([]);
+  readonly auditTarget = signal<AdminUser | null>(null);
+  readonly audit = signal<AdminUserAuditEntry[]>([]);
+
+  loadAll(): void {
+    this.loading.set(true);
+    this.gateway.loadUsers().pipe(take(1)).subscribe(users => { this.users.set(users); this.loading.set(false); });
+    this.gateway.loadRoles().pipe(take(1)).subscribe(roles => this.roles.set(roles));
+    this.gateway.loadInvitations().pipe(take(1)).subscribe(invitations => this.invitations.set(invitations));
+  }
+
+  roleName(roleId: string): string {
+    return this.roles().find(role => role.id === roleId)?.name ?? roleId;
+  }
+
+  setRole(userId: string, roleId: string): void {
+    this.gateway.setUserRole(userId, roleId).pipe(take(1)).subscribe({ next: () => this.loadAll() });
+  }
+
+  setStatus(userId: string, status: AdminUserStatus): void {
+    this.gateway.setUserStatus(userId, status).pipe(take(1)).subscribe({ next: () => this.loadAll() });
+  }
+
+  invite(email: string, roleId: string, scope: AdminUserScope): void {
+    if (!email.trim()) return;
+    this.gateway.inviteUser(email.trim(), roleId, scope).pipe(take(1)).subscribe({ next: () => this.loadAll() });
+  }
+
+  revokeInvitation(id: string): void {
+    this.gateway.revokeInvitation(id).pipe(take(1)).subscribe({ next: () => this.loadAll() });
+  }
+
+  openSessions(user: AdminUser): void {
+    this.sessionsTarget.set(user);
+    this.gateway.loadSessions(user.id).pipe(take(1)).subscribe(sessions => this.sessions.set(sessions));
+  }
+
+  closeSessions(): void {
+    this.sessionsTarget.set(null);
+  }
+
+  revokeSession(sessionId: string): void {
+    this.gateway.revokeSession(sessionId).pipe(take(1)).subscribe({
+      next: () => {
+        const user = this.sessionsTarget();
+        if (user) this.openSessions(user);
+      }
+    });
+  }
+
+  openAudit(user: AdminUser): void {
+    this.auditTarget.set(user);
+    this.gateway.loadAudit(user.id).pipe(take(1)).subscribe(entries => this.audit.set(entries));
+  }
+
+  closeAudit(): void {
+    this.auditTarget.set(null);
+  }
+}