feat(settings): Users page — list, add, rename, role, password, disable, delete (#5336)

#5336 "Users page: list accounts, change role, disable, reset a local
password, create a local user".

- Settings › Users (admin only, a Settings tab): every account with how it
  signs in, its role, last sign-in (from the audit log) and working AI
  tokens; disabled accounts last. A row opens the account.
- An account's page: rename (any account), role and password (local
  accounts; an LDAP or single sign-on role comes from the provider at
  every sign-in, and the page says so), disable or enable, and Delete
  behind the confirm dialog.
- Refusals are said beside the control: nobody disables, demotes or
  deletes themselves, the last active admin stays, and an account that
  made alert rules, maintenance windows or playbook runs is disabled
  rather than deleted (those records keep who made them).
- Add user: a local account with a role and a password of 8+ characters.
- Every change is audited as user.*, and the audit log names and links the
  account.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/app.py

@@ -215,6 +215,7 @@ def create_app(
     from .ansible.routes import ansible_bp
     from .ansible.inventory_routes import inventory_bp
     from .settings.routes import settings_bp
+    from .settings.users import users_bp
     from .audit.routes import audit_bp
     from .ai_access.routes import ai_access_bp
     from .account.routes import account_bp
@@ -228,6 +229,7 @@ def create_app(
     app.register_blueprint(ansible_bp)
     app.register_blueprint(inventory_bp)
     app.register_blueprint(settings_bp)
+    app.register_blueprint(users_bp)
     app.register_blueprint(audit_bp)
     app.register_blueprint(ai_access_bp)
     app.register_blueprint(account_bp)