feat(admin): user management — roles, suspend, delete + lifecycle emails

- New Users page tabs (Users & roles / Access requests / Demo) and a tab-ified Configuration
  page, both via a reusable Tabs component (persisted active tab).
- Admin can suspend/unsuspend (migration 0023 adds users.is_suspended) and delete accounts
  from the Users & roles tab, with guards (demo / self / last admin).
- Email notifications to the affected user: suspended (reactive, on a blocked sign-in),
  reinstated, role changed, and account deleted; the approval email now carries a clickable
  app link. The scheduled/manual demo reset also seeds sample channel subscriptions.
- Hide the 'unverified email' chip for Google accounts (Google attests the email).

backend/app/models.py

@@ -37,6 +37,12 @@ class User(Base):
     # Admin-approved & enabled. A pending password registration starts inactive; admin
     # approval activates it. A deactivated account can't log in.
     is_active: Mapped[bool] = mapped_column(Boolean, default=True, server_default="true")
+    # Admin-imposed access block, distinct from is_active (approval lifecycle). A suspended
+    # account can't sign in by any method and its live sessions are rejected; the user is told
+    # why and pointed at the operator's contact. The demo account is never suspendable.
+    is_suspended: Mapped[bool] = mapped_column(
+        Boolean, default=False, server_default="false"
+    )
     display_name: Mapped[str | None] = mapped_column(String(255))
     avatar_url: Mapped[str | None] = mapped_column(String(1024))
     role: Mapped[str] = mapped_column(String(16), default="user", server_default="user")