Add Roles & Admin/Super-Admin interface

Per organized-ideas.md §6: role assignment, account ban/unban/delete, and
direct Admin/Super-Admin CRUD of public catalog entries outside the
submission workflow.

Backend:
- list_users_for_admin(): Super-Admin-gated SECURITY DEFINER function
  joining profiles + auth.users (username, email, role, banned_until) —
  auth.users isn't exposed through PostgREST, so this is the only way to
  list accounts at all.
- New Edge Function admin-user-action (ban/unban/delete), using
  @supabase/server's `auth: 'user'` mode to verify the caller's JWT, then
  Supabase Auth's Admin API for the actual mutation. This is deliberately
  an Edge Function rather than a Postgres function like everything else in
  this codebase: touching auth.users needs the Admin API, the stable
  documented interface, not a direct write to a schema Supabase manages
  internally. Self-action guard; verify_jwt = true at the gateway on top of
  the function's own JWT verification.
- 5 new pgTAP tests (43/43 total) for list_users_for_admin (Super-Admin-only,
  even regular Admins get 42501).
- CatalogRepository gains admin* methods (direct edit of a public port/cable/
  device entry, plus adminUnpublish which flips is_public rather than
  deleting) — the update methods were already ownership-agnostic (RLS's
  is_admin() clause is what actually permits it), so these are thin aliases,
  not duplicated logic.

Frontend:
- authStore/AdminUserRepository: minimal role plumbing, shared UserRole type.
- adminUserStore + AdminUsersModal: list/role-dropdown/ban/unban/delete,
  gated to Super Admin only via a new "Manage Users" TopBar button.
- PortTypeManager/CableTypeManager/DevicePalette: built-in entries now show
  direct "Edit"/"Unpublish" for Admins (regular Admin included, per §6's
  capability table — not Super-Admin-exclusive) instead of "Suggest edit";
  unpublish reuses the review-queue's impact-check RPC before confirming.
- DeviceTemplateEditor gains an `adminMode` save path alongside its existing
  submissionMode/resubmitId ones.

Verified: tsc -b and oxlint clean; supabase db reset + 43/43 pgTAP tests
pass; confirmed both new privileged endpoints (the SQL function and the
Edge Function) actually work through the real REST API via live curl
calls — signup, email confirm, role promotion, ban/unban/delete round
trips, self-action guard, non-super-admin rejection, and verify_jwt=true
compatibility all exercised directly, not just asserted.

src/components/layout/TopBar.tsx

@@ -5,6 +5,7 @@ import { useAdminReviewStore } from '../../state/adminReviewStore'
 import { useAuthStore } from '../../state/authStore'
 import { useProjectStore } from '../../state/projectStore'
 import { useSubmissionStore } from '../../state/submissionStore'
+import AdminUsersModal from '../admin/AdminUsersModal'
 import AdminReviewModal from '../submissions/AdminReviewModal'
 import MySubmissionsModal from '../submissions/MySubmissionsModal'
 import DiagramManagerModal from './DiagramManagerModal'
@@ -37,11 +38,13 @@ export default function TopBar() {
   const username = useAuthStore((s) => s.username)
   const role = useAuthStore((s) => s.role)
   const isAdmin = role === 'admin' || role === 'super_admin'
+  const isSuperAdmin = role === 'super_admin'
   const adminPendingCount = useAdminReviewStore((s) => s.allSubmissions.filter((sub) => sub.status === 'pending').length)
   const fileInputRef = useRef<HTMLInputElement>(null)
   const [diagramManagerOpen, setDiagramManagerOpen] = useState(false)
   const [submissionsOpen, setSubmissionsOpen] = useState(false)
   const [adminReviewOpen, setAdminReviewOpen] = useState(false)
+  const [adminUsersOpen, setAdminUsersOpen] = useState(false)
 
   const pendingSubmissionCount = useMemo(
     () => mySubmissions.filter((s) => s.status === 'pending').length,
@@ -121,6 +124,14 @@ export default function TopBar() {
             )}
           </button>
         )}
+        {isSuperAdmin && (
+          <button
+            onClick={() => setAdminUsersOpen(true)}
+            className="rounded px-2.5 py-1.5 text-xs text-slate-600 hover:bg-slate-100"
+          >
+            Manage Users
+          </button>
+        )}
         <button onClick={handleImportClick} className="rounded px-2.5 py-1.5 text-xs text-slate-600 hover:bg-slate-100">
           Import
         </button>
@@ -142,6 +153,7 @@ export default function TopBar() {
       {diagramManagerOpen && <DiagramManagerModal onClose={() => setDiagramManagerOpen(false)} />}
       {submissionsOpen && <MySubmissionsModal onClose={() => setSubmissionsOpen(false)} />}
       {adminReviewOpen && <AdminReviewModal onClose={() => setAdminReviewOpen(false)} />}
+      {adminUsersOpen && <AdminUsersModal onClose={() => setAdminUsersOpen(false)} />}
     </header>
   )
 }