feat(settings): Users page — list, add, rename, role, password, disable, delete (#5336)

#5336 "Users page: list accounts, change role, disable, reset a local
password, create a local user".

- Settings › Users (admin only, a Settings tab): every account with how it
  signs in, its role, last sign-in (from the audit log) and working AI
  tokens; disabled accounts last. A row opens the account.
- An account's page: rename (any account), role and password (local
  accounts; an LDAP or single sign-on role comes from the provider at
  every sign-in, and the page says so), disable or enable, and Delete
  behind the confirm dialog.
- Refusals are said beside the control: nobody disables, demotes or
  deletes themselves, the last active admin stays, and an account that
  made alert rules, maintenance windows or playbook runs is disabled
  rather than deleted (those records keep who made them).
- Add user: a local account with a role and a password of 8+ characters.
- Every change is audited as user.*, and the audit log names and links the
  account.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/audit/service.py

@@ -19,6 +19,7 @@ from steward.models.ansible_schedule import AnsibleSchedule
 from steward.models.api_tokens import ApiToken
 from steward.models.hosts import Host
 from steward.models.monitors import Monitor
+from steward.models.users import User
 
 logger = logging.getLogger(__name__)
 
@@ -33,6 +34,7 @@ _NAMED = {
     "ansible_group": (AnsibleGroup, "/ansible/inventory/groups/{}"),
     "ansible_schedule": (AnsibleSchedule, "/ansible/schedules"),
     "api_token": (ApiToken, "/ai-access/"),
+    "user": (User, "/settings/users/{}"),
 }
 _SELF_NAMED = {"plugin": "/settings/plugins/", "ansible_playbook": None}
 
@@ -80,8 +82,9 @@ async def entity_labels(db, items: list[dict]) -> dict[tuple[str, str], dict]:
             keys = [int(i) for i in wanted if i.isdigit()] if etype == "api_token" else list(wanted)
             if not keys:
                 continue
+            name_col = model.username if model is User else model.name
             for row_id, name in (await db.execute(
-                    select(key_col, model.name).where(key_col.in_(keys)))).all():
+                    select(key_col, name_col).where(key_col.in_(keys)))).all():
                 labels[(etype, str(row_id))] = {"label": name, "url": page.format(row_id), "gone": False}
         elif etype == "ansible_run":
             runs = (await db.execute(
@@ -116,6 +119,13 @@ ACTIONS = {
     "auth.login_failed": "failed to sign in",
     "auth.setup": "set up Steward",
     "account.time_zone": "set their time zone",
+    "user.created": "added user",
+    "user.renamed": "renamed user",
+    "user.role_changed": "changed the role of user",
+    "user.password_reset": "set a new password for user",
+    "user.disabled": "disabled user",
+    "user.enabled": "enabled user",
+    "user.deleted": "deleted user",
     "host.created": "added host",
     "host.renamed": "renamed host",
     "host.deleted": "deleted host",
@@ -170,7 +180,7 @@ ACTIONS = {
 }
 
 # The filter's choices: an area, matched as a prefix of the action code.
-AREAS = (("auth.", "Sign-ins"), ("account.", "Accounts"), ("host.", "Hosts"), ("monitor.", "Monitors"),
+AREAS = (("auth.", "Sign-ins"), ("account.", "Accounts"), ("user.", "Users"), ("host.", "Hosts"), ("monitor.", "Monitors"),
          ("alert_rule.", "Alert rules"), ("maintenance_window.", "Maintenance"),
          ("ansible.run", "Playbook runs"), ("ansible.", "Ansible (all)"),
          ("settings.", "Settings"), ("plugin.", "Plugins"), ("api_token.", "AI access"),