Add user management UI and stable UUIDs for users

Backend
- New routes/users.js (admin-only via requireAdmin) with list, create,
  update (incl. password reset) and delete endpoints.
- All user-facing API responses identify users by uuid, not the
  numeric primary key — usernames can now be renamed without breaking
  external references.
- Protection rules: cannot delete or demote the last admin; cannot
  delete or demote your own account.

Schema / data
- users table gained a uuid TEXT column (unique). Existing rows are
  backfilled with crypto.randomUUID() on startup. Setup endpoint and
  the create-user CLI both generate a UUID for new users.

Frontend
- New "Benutzer" tab in nav-tabs, marked admin-only and shown only
  after /api/auth/me reports isAdmin.
- Modal with create / edit forms (password optional on edit = leave
  unchanged). XSS-safe rendering of the user list using the existing
  escapeHtml helper and data-* attributes for action buttons.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/create-user.js

@@ -3,6 +3,7 @@
 // Useful for adding additional users outside the web UI.
 
 const bcrypt = require('bcryptjs');
+const { randomUUID } = require('crypto');
 const { initDatabase, getDatabase, closeDatabase } = require('../database');
 
 async function main() {
@@ -27,17 +28,18 @@ async function main() {
     const db = getDatabase();
     const hash = await bcrypt.hash(password, 10);
 
+    const uuid = randomUUID();
     await new Promise((resolve, reject) => {
         db.run(
-            'INSERT INTO users (username, password_hash, display_name, is_admin) VALUES (?, ?, ?, ?)',
-            [username, hash, username, isAdmin ? 1 : 0],
+            'INSERT INTO users (uuid, username, password_hash, display_name, is_admin) VALUES (?, ?, ?, ?, ?)',
+            [uuid, username, hash, username, isAdmin ? 1 : 0],
             function (err) {
                 if (err) reject(err);
                 else resolve(this.lastID);
             }
         );
     }).then((id) => {
-        console.log(`User '${username}' angelegt (id=${id}, admin=${isAdmin}).`);
+        console.log(`User '${username}' angelegt (id=${id}, uuid=${uuid}, admin=${isAdmin}).`);
     }).catch((err) => {
         if (/UNIQUE/.test(err.message)) {
             console.error(`User '${username}' existiert bereits.`);