Add user management UI and stable UUIDs for users

Backend
- New routes/users.js (admin-only via requireAdmin) with list, create,
  update (incl. password reset) and delete endpoints.
- All user-facing API responses identify users by uuid, not the
  numeric primary key — usernames can now be renamed without breaking
  external references.
- Protection rules: cannot delete or demote the last admin; cannot
  delete or demote your own account.

Schema / data
- users table gained a uuid TEXT column (unique). Existing rows are
  backfilled with crypto.randomUUID() on startup. Setup endpoint and
  the create-user CLI both generate a UUID for new users.

Frontend
- New "Benutzer" tab in nav-tabs, marked admin-only and shown only
  after /api/auth/me reports isAdmin.
- Modal with create / edit forms (password optional on edit = leave
  unchanged). XSS-safe rendering of the user list using the existing
  escapeHtml helper and data-* attributes for action buttons.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

routes/auth.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const bcrypt = require('bcryptjs');
+const { randomUUID } = require('crypto');
 const rateLimit = require('express-rate-limit');
 const db = require('../db');
 const asyncHandler = require('../middleware/asyncHandler');
@@ -35,9 +36,10 @@ router.post('/setup', asyncHandler(async (req, res) => {
         return res.status(400).json({ error: 'Passwort muss mindestens 8 Zeichen lang sein' });
     }
     const hash = await bcrypt.hash(password, 10);
+    const uuid = randomUUID();
     const result = await db.run(
-        'INSERT INTO users (username, password_hash, display_name, is_admin) VALUES (?, ?, ?, 1)',
-        [username, hash, displayName || username]
+        'INSERT INTO users (uuid, username, password_hash, display_name, is_admin) VALUES (?, ?, ?, ?, 1)',
+        [uuid, username, hash, displayName || username]
     );
     req.session.userId = result.lastID;
     req.session.username = username;