Add user management UI and stable UUIDs for users

Backend
- New routes/users.js (admin-only via requireAdmin) with list, create,
  update (incl. password reset) and delete endpoints.
- All user-facing API responses identify users by uuid, not the
  numeric primary key — usernames can now be renamed without breaking
  external references.
- Protection rules: cannot delete or demote the last admin; cannot
  delete or demote your own account.

Schema / data
- users table gained a uuid TEXT column (unique). Existing rows are
  backfilled with crypto.randomUUID() on startup. Setup endpoint and
  the create-user CLI both generate a UUID for new users.

Frontend
- New "Benutzer" tab in nav-tabs, marked admin-only and shown only
  after /api/auth/me reports isAdmin.
- Modal with create / edit forms (password optional on edit = leave
  unchanged). XSS-safe rendering of the user list using the existing
  escapeHtml helper and data-* attributes for action buttons.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server.js

@@ -129,12 +129,14 @@ const dokumenteRouter = require('./routes/dokumente');
 const provisionenRouter = require('./routes/provisionen');
 const provisionsregelnRouter = require('./routes/provisionsregeln');
 const mitarbeiterRouter = require('./routes/mitarbeiter');
+const usersRouter = require('./routes/users');
 
 app.use('/api/anbieter', anbieterRouter);
 app.use('/api/tarife', tarifeRouter);
 app.use('/api/schaltungen', schaltungenRouter);
 app.use('/api/tarifoptionen', tarifoptionenRouter);
 app.use('/api/mitarbeiter-prozentsaetze', mitarbeiterRouter);
+app.use('/api/users', usersRouter);
 app.use('/api', dokumenteRouter);    // /api/schaltungen/:id/dokumente, /api/dokumente/:id/*
 app.use('/api', provisionenRouter);  // /api/provisionen, /api/schaltungen/:id/provision, /api/geloeschte-schaltungen
 app.use('/api', provisionsregelnRouter); // /api/provisionsregeln, /api/anbieter-provisionsregeln