feat(db/m7-user-mgmt): migration 0023 + admin-user CRUD queries

Adds users.auto_approve_requests boolean default false (the #355
sub-feature surface; the request-flow handler that honors this
flag is U2.5 follow-up work).

Four new sqlc queries for the U2 admin endpoints:
- CreateUserAdmin: admin-driven user creation, accepts all five
  fields explicitly.
- DeleteUser: hard delete; schema's ON DELETE CASCADE foreign
  keys handle plays/likes/sessions cleanup. Last-admin guard
  lives in the HTTP layer (next task).
- ResetUserPassword: admin sets a new hashed password without
  knowing the old one.
- UpdateUserAutoApprove: toggles the new boolean.

Self-service equivalents (knows-current-password change, etc.)
are U3 work and use distinct queries.

internal/db/queries/users.sql

@@ -81,3 +81,36 @@ SELECT
      WHERE pe.user_id = u.id) AS last_scrobbled_at
 FROM users u
 WHERE u.id = $1;
+
+-- name: CreateUserAdmin :one
+-- Admin-driven user creation. Distinct from CreateUser/CreateUserFirstAdminRace:
+-- the caller (an admin) supplies all five fields explicitly including is_admin,
+-- so an admin can promote on creation. Used by POST /api/admin/users.
+INSERT INTO users (username, password_hash, api_token, is_admin, display_name)
+VALUES ($1, $2, $3, $4, $5)
+RETURNING *;
+
+-- name: DeleteUser :exec
+-- Hard delete with cascade. The schema's ON DELETE CASCADE foreign keys
+-- handle plays/likes/sessions/etc. Caller must enforce the last-admin
+-- guard at the HTTP layer (count admins, refuse if target is the only
+-- admin). The lidarr_quarantine, general_likes*, play_events,
+-- sessions, and other user-FK tables all have ON DELETE CASCADE so
+-- this is a clean drop.
+DELETE FROM users WHERE id = $1;
+
+-- name: ResetUserPassword :exec
+-- Admin-driven password reset: caller writes a new hashed password to
+-- the target user's row. No knowledge of the old password is required
+-- (this is the admin path; self-service "knows current password" is
+-- a separate U3 query).
+UPDATE users
+   SET password_hash = $2
+ WHERE id = $1;
+
+-- name: UpdateUserAutoApprove :one
+-- Toggle the per-user auto_approve_requests flag.
+UPDATE users
+   SET auto_approve_requests = $2
+ WHERE id = $1
+RETURNING *;