Frontend: email sign-in, first-run setup, reset links, Users admin page

- AuthGate replaces the raw token prompt: first-run setup form (creates
  the admin) when no accounts exist, email/password sign-in with a
  forgot-password flow, and a collapsible raw-API-token fallback for
  legacy/script setups.
- /reset is a public page where invite and password-reset links land;
  success stores the fresh session and enters the dashboard.
- Users section (admin-only nav): invite by email (link always shown,
  emailed when SMTP is configured), admin/disable toggles, reset links,
  and delete with the shared-resources handoff spelled out.
- Sidebar shows who is signed in; sign-out revokes the session
  server-side.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ws7xj5Ej623hh4GXQCYYR

frontend/app/users/page.tsx

@@ -0,0 +1,12 @@
+/* Users page (admin only — the sidebar hides it otherwise; the API enforces it). */
+"use client";
+
+import { UsersSection } from "@/components/sections/UsersSection";
+
+export default function UsersPage() {
+  return (
+    <div className="main-scroll">
+      <UsersSection />
+    </div>
+  );
+}