Add user management UI and stable UUIDs for users

Backend
- New routes/users.js (admin-only via requireAdmin) with list, create,
  update (incl. password reset) and delete endpoints.
- All user-facing API responses identify users by uuid, not the
  numeric primary key — usernames can now be renamed without breaking
  external references.
- Protection rules: cannot delete or demote the last admin; cannot
  delete or demote your own account.

Schema / data
- users table gained a uuid TEXT column (unique). Existing rows are
  backfilled with crypto.randomUUID() on startup. Setup endpoint and
  the create-user CLI both generate a UUID for new users.

Frontend
- New "Benutzer" tab in nav-tabs, marked admin-only and shown only
  after /api/auth/me reports isAdmin.
- Modal with create / edit forms (password optional on edit = leave
  unchanged). XSS-safe rendering of the user list using the existing
  escapeHtml helper and data-* attributes for action buttons.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

database.js

@@ -230,15 +230,32 @@ function initDatabase() {
             UNIQUE(schaltung_id, tarifoption_id)
         )`);
 
-        // Users for authentication
+        // Users for authentication. uuid is the stable external identifier exposed
+        // through the API so usernames can be renamed without breaking references.
         db.run(`CREATE TABLE IF NOT EXISTS users (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
+            uuid TEXT UNIQUE,
             username TEXT NOT NULL UNIQUE,
             password_hash TEXT NOT NULL,
             display_name TEXT,
             is_admin INTEGER NOT NULL DEFAULT 0,
             created_at DATETIME DEFAULT CURRENT_TIMESTAMP
         )`);
+        addColumnIfMissing(db, 'users', 'uuid TEXT');
+        // Backfill UUIDs for rows that pre-date the column.
+        db.all('SELECT id FROM users WHERE uuid IS NULL OR uuid = ""', (err, rows) => {
+            if (err) {
+                console.error('Backfill uuid lookup failed:', err.message);
+                return;
+            }
+            if (!rows || rows.length === 0) return;
+            const { randomUUID } = require('crypto');
+            for (const row of rows) {
+                db.run('UPDATE users SET uuid = ? WHERE id = ?', [randomUUID(), row.id], (uerr) => {
+                    if (uerr) console.error('Backfill uuid update failed:', uerr.message);
+                });
+            }
+        });
 
         // Seed data (idempotent)
         db.run(`INSERT OR IGNORE INTO anbieter (name) VALUES