Give local users their own manager: custom passwords and role reassignment

Move user management out of Settings into its own /users page (nav-gated
to owners), let an owner type a specific password on reset instead of
always generating a random one, and add role reassignment via a new
PUT /auth/users/{id}/role endpoint. Role changes revoke the target's
existing sessions, same as a password reset, so a demoted user can't
keep acting under a stale, higher-privileged session.

api/localauth/fake_test.go

@@ -100,6 +100,20 @@ func (f *fakeStore) SetPasswordHash(_ context.Context, userID, hash string) erro
 	return nil
 }
 
+func (f *fakeStore) SetRole(_ context.Context, userID string, role authz.Role) error {
+	u, ok := f.users[userID]
+	if !ok {
+		return ErrNotFound
+	}
+	u.Role = role
+	for h, sess := range f.sessions {
+		if sess.UserID == userID {
+			delete(f.sessions, h)
+		}
+	}
+	return nil
+}
+
 func (f *fakeStore) CountLocalUsers(_ context.Context) (int, error) {
 	return len(f.users), nil
 }