feat(auth): account lifecycle — Google linking, passwords, suspension & deletion plumbing

- Link a Google account to a password account, and adopt the Google identity onto a matching
  email account instead of 500ing on a duplicate; set or change a password from Settings.
- Expose has_google/has_password on /api/me for the Sign-in methods UI.
- Mark Google logins email-verified (backfill existing rows, migration 0024); stop a routine
  login from clobbering an admin-assigned role (env ADMIN_EMAILS stays the bootstrap admin).
- Suspension login-gates (password + Google callback + current_user) with a rate-limited
  'suspended' notice; shared purge_user (cascade delete + access-request cleanup + Google-grant
  revoke) behind self- and admin-deletion; single app_base source for user-facing email links.

frontend/src/lib/api.ts

@@ -9,6 +9,8 @@ export interface Me {
   avatar_url: string | null;
   role: string;
   is_demo: boolean;
+  has_google: boolean;
+  has_password: boolean;
   can_read: boolean;
   can_write: boolean;
   pending_invites: number;
@@ -199,6 +201,15 @@ interface ReqConfig {
   quiet?: boolean;
 }
 
+// Set by the app shell. Invoked whenever any request returns 401 so a session that ended
+// server-side (account suspended/deleted while the tab was open) can drop the user to the login
+// page. The handler itself guards against firing when we were never signed in (public pages
+// legitimately 401 on /api/me), so it's safe to call for every 401.
+let onUnauthorized: (() => void) | null = null;
+export function setUnauthorizedHandler(fn: (() => void) | null): void {
+  onUnauthorized = fn;
+}
+
 async function req(url: string, opts: RequestInit = {}, cfg: ReqConfig = {}): Promise<any> {
   const method = opts.method ?? "GET";
   const canRetry = cfg.idempotent ?? method === "GET";
@@ -251,6 +262,10 @@ async function req(url: string, opts: RequestInit = {}, cfg: ReqConfig = {}): Pr
       // 400/409/422 (validation/conflict). 401/403/404 are caller-handled control flow.
       if (RETRIABLE_GATEWAY.has(r.status)) {
         markConnectivityLost();
+      } else if (r.status === 401) {
+        // Session ended server-side (e.g. the account was suspended or deleted mid-visit). Let the
+        // app shell decide what to do (drop to the login page if we were signed in). Not a modal.
+        onUnauthorized?.();
       } else if (cfg.quiet) {
         /* caller handles the error inline — no global modal */
       } else if (r.status >= 500) {
@@ -470,6 +485,7 @@ export interface AdminUserRow {
   display_name: string | null;
   role: string; // "user" | "admin"
   is_active: boolean;
+  is_suspended: boolean;
   email_verified: boolean;
   is_demo: boolean;
   has_password: boolean;
@@ -599,6 +615,10 @@ export const api = {
   adminUsers: (): Promise<AdminUserRow[]> => req("/api/admin/users"),
   setUserRole: (id: number, role: "user" | "admin"): Promise<AdminUserRow> =>
     req(`/api/admin/users/${id}/role`, { method: "PATCH", body: JSON.stringify({ role }) }),
+  setUserSuspended: (id: number, suspended: boolean): Promise<AdminUserRow> =>
+    req(`/api/admin/users/${id}/suspend`, { method: "PATCH", body: JSON.stringify({ suspended }) }),
+  adminDeleteUser: (id: number): Promise<{ deleted: number }> =>
+    req(`/api/admin/users/${id}`, { method: "DELETE" }),
   schedulerStatus: (): Promise<SchedulerStatus> => req("/api/admin/scheduler"),
   updateSchedulerJob: (jobId: string, intervalMinutes: number): Promise<{ id: string; interval_minutes: number }> =>
     req(`/api/admin/scheduler/jobs/${jobId}`, {
@@ -624,6 +644,13 @@ export const api = {
     req("/auth/password-reset/request", { method: "POST", body: JSON.stringify({ email }) }, { quiet: true }),
   confirmPasswordReset: (token: string, password: string): Promise<{ ok: boolean }> =>
     req("/auth/password-reset/confirm", { method: "POST", body: JSON.stringify({ token, password }) }, { quiet: true }),
+  // Set or change the signed-in account's password (errors shown inline via quiet).
+  setPassword: (password: string, currentPassword?: string): Promise<{ ok: boolean }> =>
+    req(
+      "/auth/set-password",
+      { method: "POST", body: JSON.stringify({ password, current_password: currentPassword }) },
+      { quiet: true }
+    ),
   // --- onboarding / admin ---
   requestAccess: (email: string): Promise<{ status: string }> =>
     req("/auth/request-access", { method: "POST", body: JSON.stringify({ email }) }),