feat(admin): users and permissions

Sprint 25.

New features/admin/users/ module, net-new /:lang/backoffice/users route +
Dashboard Quick Action.

- users: name, Telegram username, scope (marketplace vs office admin),
  role (inline change), status (active/invited/suspended), last login
- 4 built-in roles (owner/admin/editor/viewer) with flat permission lists
- invitations: email + role + scope form, pending list + revoke (no email
  actually sends - local record only)
- passwordless login confirmed already real (AdminAuthService Telegram QR,
  docs/BACKEND.md item 1) - linked, not reimplemented
- per-user mock session list (device/IP/last-active, revoke) - flagged as
  mock since the real AdminAuthService only ever tracks the current
  browser's session
- per-user audit log dialog (role/status changes), same pattern as
  Sprint 24's per-transaction audit, intentionally separate from the
  system-wide log planned for Sprint 26

docs/ADMIN.md + docs/BACKEND.md (new item 14) updated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/features/admin/users/pages/admin-users-page.component.ts

@@ -0,0 +1,46 @@
+import { ChangeDetectionStrategy, Component, inject, signal } from '@angular/core';
+import { CommonModule } from '@angular/common';
+import { FormsModule } from '@angular/forms';
+import { AdminUsersFacade } from '../facade/admin-users.facade';
+import { AdminUserScope, AdminUserStatus } from '../models/admin-user.model';
+import { TranslatePipe } from '../../../../i18n/translate.pipe';
+import { TranslateService } from '../../../../i18n/translate.service';
+import { ButtonComponent } from '../../../../shared/ui/button/button.component';
+import { InputComponent } from '../../../../shared/ui/input/input.component';
+import { BadgeComponent } from '../../../../shared/ui/badge/badge.component';
+import { TableComponent } from '../../../../shared/ui/table/table.component';
+import { DialogComponent } from '../../../../shared/ui/dialog/dialog.component';
+
+@Component({
+  selector: 'app-admin-users-page',
+  standalone: true,
+  imports: [CommonModule, FormsModule, TranslatePipe, ButtonComponent, InputComponent, BadgeComponent, TableComponent, DialogComponent],
+  templateUrl: './admin-users-page.component.html',
+  styleUrls: ['./admin-users-page.component.scss'],
+  changeDetection: ChangeDetectionStrategy.OnPush
+})
+export class AdminUsersPageComponent {
+  readonly facade = inject(AdminUsersFacade);
+  private readonly translate = inject(TranslateService);
+
+  readonly inviteEmail = signal('');
+  readonly inviteRoleId = signal('viewer');
+  readonly inviteScope = signal<AdminUserScope>('office');
+
+  constructor() {
+    this.facade.loadAll();
+  }
+
+  sendInvite(): void {
+    this.facade.invite(this.inviteEmail(), this.inviteRoleId(), this.inviteScope());
+    this.inviteEmail.set('');
+  }
+
+  toggleStatus(userId: string, current: AdminUserStatus): void {
+    const next: AdminUserStatus = current === 'suspended' ? 'active' : 'suspended';
+    if (next === 'suspended' && !window.confirm(this.translate.t('adminUsers.confirmSuspend'))) {
+      return;
+    }
+    this.facade.setStatus(userId, next);
+  }
+}