feat(admin): user management — roles, suspend, delete + lifecycle emails

- New Users page tabs (Users & roles / Access requests / Demo) and a tab-ified Configuration
  page, both via a reusable Tabs component (persisted active tab).
- Admin can suspend/unsuspend (migration 0023 adds users.is_suspended) and delete accounts
  from the Users & roles tab, with guards (demo / self / last admin).
- Email notifications to the affected user: suspended (reactive, on a blocked sign-in),
  reinstated, role changed, and account deleted; the approval email now carries a clickable
  app link. The scheduled/manual demo reset also seeds sample channel subscriptions.
- Hide the 'unverified email' chip for Google accounts (Google attests the email).

backend/app/routes/admin.py

@@ -8,13 +8,14 @@ from sqlalchemy import delete, func, select
 from sqlalchemy.orm import Session
 
 from app import email as email_mod
-from app.auth import current_user, get_or_create_demo_user
+from app.auth import current_user, get_or_create_demo_user, operator_contact, purge_user
 from app.db import get_db
 from app.models import (
     DemoWhitelist,
     Invite,
     Playlist,
     PlaylistItem,
+    Subscription,
     User,
     Video,
     VideoState,
@@ -132,6 +133,7 @@ def _serialize_user(u: User) -> dict:
         "display_name": u.display_name,
         "role": u.role,
         "is_active": u.is_active,
+        "is_suspended": u.is_suspended,
         "email_verified": u.email_verified,
         "is_demo": u.is_demo,
         "has_password": u.password_hash is not None,
@@ -150,11 +152,12 @@ def list_users(_: User = Depends(admin_user), db: Session = Depends(get_db)) ->
 def set_user_role(
     user_id: int,
     payload: dict,
+    background: BackgroundTasks,
     admin: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """Promote/demote a user. Guards: can't change your own role, can't touch the demo
-    account, and can't remove the last remaining admin."""
+    account, and can't remove the last remaining admin. Emails the user when it actually changes."""
     role = payload.get("role")
     if role not in ("user", "admin"):
         raise HTTPException(status_code=400, detail="role must be 'user' or 'admin'")
@@ -169,11 +172,82 @@ def set_user_role(
         admin_count = db.scalar(select(func.count()).select_from(User).where(User.role == "admin"))
         if (admin_count or 0) <= 1:
             raise HTTPException(status_code=400, detail="Can't remove the last admin.")
+    changed = target.role != role
     target.role = role
     db.commit()
+    if changed:
+        background.add_task(email_mod.send_role_changed, target.email, role, operator_contact())
     return _serialize_user(target)
 
 
+@router.patch("/users/{user_id}/suspend")
+def set_user_suspended(
+    user_id: int,
+    payload: dict,
+    background: BackgroundTasks,
+    admin: User = Depends(admin_user),
+    db: Session = Depends(get_db),
+) -> dict:
+    """Suspend or un-suspend an account. A suspended user can't sign in by any method and any
+    live session is dropped on its next request. Guards: can't suspend the demo account, can't
+    suspend yourself, and can't suspend the last active admin (that would lock admin out). On
+    un-suspend the user is emailed they can return (suspend is announced reactively, on a blocked
+    sign-in)."""
+    suspended = bool(payload.get("suspended"))
+    target = db.get(User, user_id)
+    if target is None:
+        raise HTTPException(status_code=404, detail="No such user")
+    if target.is_demo:
+        raise HTTPException(status_code=400, detail="The demo account can't be suspended.")
+    if target.id == admin.id:
+        raise HTTPException(status_code=400, detail="You can't suspend your own account.")
+    if suspended and target.role == "admin" and not target.is_suspended:
+        active_admins = db.scalar(
+            select(func.count())
+            .select_from(User)
+            .where(User.role == "admin", User.is_suspended.is_(False))
+        )
+        if (active_admins or 0) <= 1:
+            raise HTTPException(status_code=400, detail="Can't suspend the last active admin.")
+    was_suspended = target.is_suspended
+    target.is_suspended = suspended
+    db.commit()
+    if was_suspended and not suspended:
+        background.add_task(
+            email_mod.send_account_unsuspended, target.email, operator_contact()
+        )
+    return _serialize_user(target)
+
+
+@router.delete("/users/{user_id}")
+def admin_delete_user(
+    user_id: int,
+    background: BackgroundTasks,
+    admin: User = Depends(admin_user),
+    db: Session = Depends(get_db),
+) -> dict:
+    """Admin-triggered account deletion — the same full erasure a user can perform on themselves
+    (cascade delete of all personal data + access-request cleanup + Google-grant revoke). Guards:
+    not the demo account, not yourself (use Settings → Account), and not the last admin."""
+    target = db.get(User, user_id)
+    if target is None:
+        raise HTTPException(status_code=404, detail="No such user")
+    if target.is_demo:
+        raise HTTPException(status_code=400, detail="The demo account can't be deleted.")
+    if target.id == admin.id:
+        raise HTTPException(
+            status_code=400, detail="Delete your own account from Settings → Account."
+        )
+    if target.role == "admin":
+        admin_count = db.scalar(
+            select(func.count()).select_from(User).where(User.role == "admin")
+        )
+        if (admin_count or 0) <= 1:
+            raise HTTPException(status_code=400, detail="Can't delete the last admin.")
+    purge_user(db, target, background)
+    return {"deleted": user_id}
+
+
 # --- Demo account: email whitelist + state reset -------------------------------------
 
 def _serialize_demo(row: DemoWhitelist) -> dict:
@@ -270,16 +344,35 @@ def _seed_demo_playlists(db: Session, demo: User) -> int:
     return created
 
 
+def _seed_demo_subscriptions(db: Session, demo: User, n: int = 14) -> int:
+    """Seed the demo with a handful of catalog channels (the ones with the most videos) so its
+    Channel manager isn't empty — gives visitors something to explore and matches the landing-page
+    screenshot. Idempotent: clears the demo's subscriptions first, then re-adds the top N."""
+    db.execute(delete(Subscription).where(Subscription.user_id == demo.id))
+    top = db.execute(
+        select(Video.channel_id)
+        .where(Video.channel_id.is_not(None))
+        .group_by(Video.channel_id)
+        .order_by(func.count().desc())
+        .limit(n)
+    ).scalars().all()
+    for channel_id in top:
+        db.add(Subscription(user_id=demo.id, channel_id=channel_id))
+    return len(top)
+
+
 def reset_demo_state(db: Session, demo: User) -> int:
     """Wipe the demo account's per-user state (watch/save/hide states, playlists, preferences)
-    back to a clean baseline and re-seed a few sample playlists. Returns the seeded count.
-    Shared by the admin's manual reset button and the scheduled demo reset (see scheduler)."""
+    back to a clean baseline and re-seed a few sample playlists + channel subscriptions. Returns
+    the seeded playlist count. Shared by the admin's manual reset button and the scheduled demo
+    reset (see scheduler)."""
     db.execute(delete(VideoState).where(VideoState.user_id == demo.id))
     # Playlist items cascade on playlist delete (ondelete="CASCADE").
     db.execute(delete(Playlist).where(Playlist.user_id == demo.id))
     demo.preferences = {"language": "en"}
     db.commit()
     seeded = _seed_demo_playlists(db, demo)
+    _seed_demo_subscriptions(db, demo)
     db.commit()
     return seeded