feat(server/m7-user-mgmt): admin endpoints (invites, users, promote/demote)

Five admin endpoints under existing RequireAdmin middleware:

- GET /api/admin/invites — list active + recently-redeemed
- POST /api/admin/invites — generate 24h invite, returns
  {token, expires_at, ...}. Audits ActionInviteCreate.
- DELETE /api/admin/invites/{token} — revoke unredeemed invite.
  Audits ActionInviteRevoke.
- GET /api/admin/users — list all users (id, username,
  display_name, is_admin, created_at).
- PUT /api/admin/users/{id}/admin — toggle is_admin with
  last-admin guard. Audits ActionPromoteAdmin / ActionDemoteAdmin.

Last-admin guard counts admins, refuses demotion of the sole
admin with 409 'last_admin'. Race window between count and update
is acceptable for v1 — worst case is 'no admins left,' which the
env-driven bootstrap or CLI reset can recover from. Common path
('admin demotes themselves') is now blocked.

Adds ListUsers, CountAdmins, UpdateUserAdmin sqlc queries to
users.sql.

Tests cover: invite create/list/delete round-trip, non-admin gets
403, user list, promote happy path, last-admin demotion refused,
two-admins demotion allowed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/api/admin_users.go

@@ -0,0 +1,128 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/jackc/pgx/v5/pgtype"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/audit"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
+)
+
+type adminUserView struct {
+	ID          string  `json:"id"`
+	Username    string  `json:"username"`
+	DisplayName *string `json:"display_name"`
+	IsAdmin     bool    `json:"is_admin"`
+	CreatedAt   string  `json:"created_at"`
+}
+
+type listUsersResp struct {
+	Users []adminUserView `json:"users"`
+}
+
+func (h *handlers) handleAdminListUsers(w http.ResponseWriter, r *http.Request) {
+	q := dbq.New(h.pool)
+	rows, err := q.ListUsers(r.Context())
+	if err != nil {
+		h.logger.Error("admin: list users failed", "err", err)
+		writeErr(w, http.StatusInternalServerError, "server_error", "")
+		return
+	}
+	out := make([]adminUserView, 0, len(rows))
+	for _, row := range rows {
+		v := adminUserView{
+			ID:          uuidToString(row.ID),
+			Username:    row.Username,
+			DisplayName: row.DisplayName,
+			IsAdmin:     row.IsAdmin,
+			CreatedAt:   row.CreatedAt.Time.UTC().Format(time.RFC3339),
+		}
+		out = append(out, v)
+	}
+	writeJSON(w, http.StatusOK, listUsersResp{Users: out})
+}
+
+type updateUserAdminReq struct {
+	IsAdmin bool `json:"is_admin"`
+}
+
+func (h *handlers) handleUpdateUserAdmin(w http.ResponseWriter, r *http.Request) {
+	caller, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeErr(w, http.StatusUnauthorized, "auth_required", "")
+		return
+	}
+	targetID, ok := parseUUID(chi.URLParam(r, "id"))
+	if !ok {
+		writeErr(w, http.StatusBadRequest, "invalid_id", "")
+		return
+	}
+	var req updateUserAdminReq
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeErr(w, http.StatusBadRequest, "invalid_body", "")
+		return
+	}
+
+	q := dbq.New(h.pool)
+
+	// Last-admin guard: if demoting (is_admin=false) AND target is
+	// currently the only admin, refuse. The check has a race window
+	// (between counting and updating, another admin could be demoted)
+	// but the worst-case outcome is "no admins left," which the
+	// operator can recover from via the env-driven bootstrap or the
+	// CLI password-reset path. The check still prevents the common
+	// path of "admin demotes themselves and loses access."
+	if !req.IsAdmin {
+		count, err := q.CountAdmins(r.Context())
+		if err != nil {
+			h.logger.Error("admin: count admins failed", "err", err)
+			writeErr(w, http.StatusInternalServerError, "server_error", "")
+			return
+		}
+		// We need to know whether the target is currently an admin.
+		// If they're already not-admin, the demote is a no-op (we
+		// allow it). If they ARE admin and they're the last one, refuse.
+		current, err := q.GetUserByID(r.Context(), targetID)
+		if err != nil {
+			h.logger.Error("admin: get user failed", "err", err)
+			writeErr(w, http.StatusInternalServerError, "server_error", "")
+			return
+		}
+		if current.IsAdmin && count <= 1 {
+			writeErr(w, http.StatusConflict, "last_admin",
+				"can't remove the last admin — promote someone else first")
+			return
+		}
+	}
+
+	updated, err := q.UpdateUserAdmin(r.Context(), dbq.UpdateUserAdminParams{
+		ID:      targetID,
+		IsAdmin: req.IsAdmin,
+	})
+	if err != nil {
+		h.logger.Error("admin: update user admin failed", "err", err)
+		writeErr(w, http.StatusInternalServerError, "server_error", "")
+		return
+	}
+
+	action := audit.ActionPromoteAdmin
+	if !req.IsAdmin {
+		action = audit.ActionDemoteAdmin
+	}
+	if err := audit.Write(r.Context(), h.pool, caller.ID, targetID, action, nil); err != nil {
+		h.logger.Warn("admin: promote/demote audit failed", "err", err)
+	}
+
+	writeJSON(w, http.StatusOK, adminUserView{
+		ID:          uuidToString(updated.ID),
+		Username:    updated.Username,
+		DisplayName: updated.DisplayName,
+		IsAdmin:     updated.IsAdmin,
+		CreatedAt:   updated.CreatedAt.Time.UTC().Format(time.RFC3339),
+	})
+}