Frontend: email sign-in, first-run setup, reset links, Users admin page

- AuthGate replaces the raw token prompt: first-run setup form (creates
  the admin) when no accounts exist, email/password sign-in with a
  forgot-password flow, and a collapsible raw-API-token fallback for
  legacy/script setups.
- /reset is a public page where invite and password-reset links land;
  success stores the fresh session and enters the dashboard.
- Users section (admin-only nav): invite by email (link always shown,
  emailed when SMTP is configured), admin/disable toggles, reset links,
  and delete with the shared-resources handoff spelled out.
- Sidebar shows who is signed in; sign-out revokes the session
  server-side.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ws7xj5Ej623hh4GXQCYYR

frontend/lib/nav.ts

@@ -20,6 +20,8 @@ export const NAV_ROUTES: NavRoute[] = [
   { key: "shared", href: "/shared", label: "Shared" },
   { key: "memory", href: "/memory", label: "Memory" },
   { key: "claude", href: "/claude", label: "Claude" },
+  // Admin-only: the Shell hides this entry for non-admin sessions.
+  { key: "users", href: "/users", label: "Users" },
 ];
 
 /* Map a browser path back to its section key. Trailing slashes (Next emits them under