feat(auth): admin Users page + allow_registration toggle (5a frontend)

New admin-only Users page (sidebar): Users & roles (list + promote/demote with
confirm; self/demo/last-admin guarded server-side), plus the Access requests
(Invite whitelist) and Demo whitelist+reset migrated out of Settings → Account
(same data/tables — UI relocated only). Settings → Account now holds personal
content only. ConfigPanel learns a boolean field type (toggle) for the new
allow_registration setting. api methods, new 'users' page/route/nav/header, and
EN/HU/DE strings (new users namespace + access group).

frontend/src/i18n/locales/en/config.json

@@ -2,6 +2,7 @@
   "intro": "Operational settings stored in the database — these override the file/env defaults and take effect without a redeploy. Leave a field empty (or reset it) to fall back to the default.",
   "loading": "Loading configuration…",
   "groups": {
+    "access": "Access",
     "email": "Email / SMTP",
     "youtube": "YouTube API",
     "quota": "Quota",
@@ -23,7 +24,8 @@
     "shorts_probe_batch": { "label": "Shorts probe — batch size", "hint": "How many videos to classify per run." },
     "enrich_batch_size": { "label": "Enrichment batch size", "hint": "videos.list ids per call (YouTube caps this at 50)." },
     "autotag_title_sample": { "label": "Auto-tag title sample", "hint": "Recent video titles sampled per channel for language detection." },
-    "youtube_api_key": { "label": "YouTube API key", "hint": "Optional. Used for public reads (channels/videos) so shared backfill doesn't depend on a user's OAuth. Stored encrypted; write-only." }
+    "youtube_api_key": { "label": "YouTube API key", "hint": "Optional. Used for public reads (channels/videos) so shared backfill doesn't depend on a user's OAuth. Stored encrypted; write-only." },
+    "allow_registration": { "label": "Allow registration", "hint": "When on, anyone can submit an email+password registration. They still need to verify their email and be approved by an admin before they can sign in." }
   },
   "save": "Save",
   "saving": "Saving…",

frontend/src/i18n/locales/en/header.json

@@ -5,6 +5,7 @@
   "usageStats": "Usage & stats",
   "scheduler": "Scheduler",
   "configuration": "Configuration",
+  "users": "Users",
   "scope": {
     "label": "Feed source",
     "my": "Mine",
@@ -20,6 +21,7 @@
     "stats": "Stats",
     "scheduler": "Scheduler",
     "config": "Configuration",
+    "users": "Users",
     "settings": "Settings",
     "about": "About",
     "signOut": "Sign out",

frontend/src/i18n/locales/en/users.json

@@ -0,0 +1,21 @@
+{
+  "roles": {
+    "title": "Users & roles",
+    "intro": "Everyone who can sign in. Promote a user to admin, or back to a regular user.",
+    "empty": "No users yet.",
+    "you": "you",
+    "admin": "Admin",
+    "demo": "Demo",
+    "pending": "Pending approval",
+    "unverified": "Unverified email",
+    "demoLocked": "The demo account's role can't be changed.",
+    "selfLocked": "You can't change your own role.",
+    "makeAdmin": "Make admin",
+    "makeUser": "Make user",
+    "updated": "Role updated",
+    "promoteTitle": "Make admin?",
+    "demoteTitle": "Remove admin?",
+    "promoteConfirm": "Give {{email}} full admin access (settings, scheduler, user management)?",
+    "demoteConfirm": "Remove admin access from {{email}}? They'll become a regular user."
+  }
+}