feat(auth): admin Users page + allow_registration toggle (5a frontend)

New admin-only Users page (sidebar): Users & roles (list + promote/demote with
confirm; self/demo/last-admin guarded server-side), plus the Access requests
(Invite whitelist) and Demo whitelist+reset migrated out of Settings → Account
(same data/tables — UI relocated only). Settings → Account now holds personal
content only. ConfigPanel learns a boolean field type (toggle) for the new
allow_registration setting. api methods, new 'users' page/route/nav/header, and
EN/HU/DE strings (new users namespace + access group).

frontend/src/lib/api.ts

@@ -458,6 +458,20 @@ export interface SystemConfigData {
   secrets_manageable: boolean;
 }
 
+// Admin Users & roles page.
+export interface AdminUserRow {
+  id: number;
+  email: string;
+  display_name: string | null;
+  role: string; // "user" | "admin"
+  is_active: boolean;
+  email_verified: boolean;
+  is_demo: boolean;
+  has_password: boolean;
+  has_google: boolean;
+  created_at: string | null;
+}
+
 export const api = {
   me: (): Promise<Me> => req("/api/me"),
   accounts: (): Promise<Account[]> => req("/api/me/accounts"),
@@ -574,6 +588,10 @@ export const api = {
     req(`/api/admin/config/${key}`, { method: "DELETE" }),
   testEmail: (): Promise<{ sent: boolean; to: string }> =>
     req("/api/admin/config/test-email", { method: "POST" }),
+  // --- admin: users & roles ---
+  adminUsers: (): Promise<AdminUserRow[]> => req("/api/admin/users"),
+  setUserRole: (id: number, role: "user" | "admin"): Promise<AdminUserRow> =>
+    req(`/api/admin/users/${id}/role`, { method: "PATCH", body: JSON.stringify({ role }) }),
   schedulerStatus: (): Promise<SchedulerStatus> => req("/api/admin/scheduler"),
   updateSchedulerJob: (jobId: string, intervalMinutes: number): Promise<{ id: string; interval_minutes: number }> =>
     req(`/api/admin/scheduler/jobs/${jobId}`, {

frontend/src/lib/urlState.ts

@@ -89,6 +89,7 @@ export const PAGES = [
   "settings",
   "scheduler",
   "config",
+  "users",
   "notifications",
 ] as const;