feat(auth): admin Users page + allow_registration toggle (5a frontend)

New admin-only Users page (sidebar): Users & roles (list + promote/demote with
confirm; self/demo/last-admin guarded server-side), plus the Access requests
(Invite whitelist) and Demo whitelist+reset migrated out of Settings → Account
(same data/tables — UI relocated only). Settings → Account now holds personal
content only. ConfigPanel learns a boolean field type (toggle) for the new
allow_registration setting. api methods, new 'users' page/route/nav/header, and
EN/HU/DE strings (new users namespace + access group).

frontend/src/i18n/locales/en/users.json

@@ -0,0 +1,21 @@
+{
+  "roles": {
+    "title": "Users & roles",
+    "intro": "Everyone who can sign in. Promote a user to admin, or back to a regular user.",
+    "empty": "No users yet.",
+    "you": "you",
+    "admin": "Admin",
+    "demo": "Demo",
+    "pending": "Pending approval",
+    "unverified": "Unverified email",
+    "demoLocked": "The demo account's role can't be changed.",
+    "selfLocked": "You can't change your own role.",
+    "makeAdmin": "Make admin",
+    "makeUser": "Make user",
+    "updated": "Role updated",
+    "promoteTitle": "Make admin?",
+    "demoteTitle": "Remove admin?",
+    "promoteConfirm": "Give {{email}} full admin access (settings, scheduler, user management)?",
+    "demoteConfirm": "Remove admin access from {{email}}? They'll become a regular user."
+  }
+}