feat(admin): user management — roles, suspend, delete + lifecycle emails

- New Users page tabs (Users & roles / Access requests / Demo) and a tab-ified Configuration
  page, both via a reusable Tabs component (persisted active tab).
- Admin can suspend/unsuspend (migration 0023 adds users.is_suspended) and delete accounts
  from the Users & roles tab, with guards (demo / self / last admin).
- Email notifications to the affected user: suspended (reactive, on a blocked sign-in),
  reinstated, role changed, and account deleted; the approval email now carries a clickable
  app link. The scheduled/manual demo reset also seeds sample channel subscriptions.
- Hide the 'unverified email' chip for Google accounts (Google attests the email).

backend/app/email.py

@@ -74,8 +74,8 @@ def send_access_approved(email: str) -> bool:
     body = (
         "Hi,\n\n"
         "Your request to use Siftlode has been approved — welcome aboard.\n\n"
-        "Just open Siftlode and sign in with this Google account, and your YouTube\n"
-        "subscriptions feed will be ready.\n\n"
+        "Open Siftlode and sign in, and your YouTube subscriptions feed will be ready:\n\n"
+        f"{settings.app_base}\n\n"
         "If you weren't expecting this, you can ignore the message.\n\n"
         "— Siftlode"
         + (f"\n\nQuestions? Just reply to this email ({admin})." if admin else "")
@@ -83,6 +83,64 @@ def send_access_approved(email: str) -> bool:
     return _send([email], "You're in — your Siftlode access is approved", body, reply_to=admin)
 
 
+def send_role_changed(to: str, role: str, operator: str | None) -> bool:
+    line = (
+        "You've been granted admin access on Siftlode — you can now manage settings, the "
+        "scheduler and users."
+        if role == "admin"
+        else "Your admin access on Siftlode has been removed — you're now a regular user."
+    )
+    contact = f"\n\nQuestions? Contact the operator at {operator}." if operator else ""
+    body = "Hi,\n\n" + line + contact + "\n\n— Siftlode"
+    return _send([to], "Your Siftlode role has changed", body, reply_to=operator)
+
+
+def send_account_unsuspended(to: str, operator: str | None) -> bool:
+    contact = f"\n\nQuestions? Contact the operator at {operator}." if operator else ""
+    body = (
+        "Hi,\n\n"
+        "Your Siftlode account has been reinstated — the suspension was lifted and you can sign "
+        "in again."
+        + contact
+        + "\n\n— Siftlode"
+    )
+    return _send([to], "Your Siftlode account has been reinstated", body, reply_to=operator)
+
+
+def send_account_deleted(to: str, operator: str | None) -> bool:
+    contact = (
+        f"\n\nIf you didn't request this, contact the Siftlode operator at {operator}."
+        if operator
+        else ""
+    )
+    body = (
+        "Hi,\n\n"
+        "Your Siftlode account and all associated data — subscriptions, tags, watch history, "
+        "playlists and settings — have been permanently deleted. Nothing is retained.\n\n"
+        "Thanks for having used Siftlode."
+        + contact
+        + "\n\n— Siftlode"
+    )
+    return _send([to], "Your Siftlode account has been deleted", body, reply_to=operator)
+
+
+def send_account_suspended(to: str, operator: str | None) -> bool:
+    contact = (
+        f"If you think this is a mistake or have questions, contact the Siftlode operator "
+        f"at {operator}.\n\n"
+        if operator
+        else "If you think this is a mistake, please contact the Siftlode operator.\n\n"
+    )
+    body = (
+        "Hi,\n\n"
+        "A sign-in to your Siftlode account was just attempted, but the account is currently "
+        "suspended, so access was denied.\n\n"
+        + contact
+        + "— Siftlode"
+    )
+    return _send([to], "Your Siftlode account is suspended", body, reply_to=operator)
+
+
 def send_admin_new_request(admins: list[str], requester: str) -> bool:
     body = (
         f"{requester} just requested access to Siftlode.\n\n"