feat(users): Multi-User-Management — DB-backed Login-Accounts + UI

- internal/services/users: Repo mit CRUD, bcrypt (cost 12), Upsert für
  setup-store-Admin-Migration, RecordLogin
- internal/handlers/users: GET/POST/PUT /users, POST /users/:id/password,
  DELETE /users/:id; Schutz gegen Selbst-Löschung
- auth.go Login: DB-Nutzer first, Fallback auf setup-store-Admin;
  bei erfolgreichem Fallback wird der Admin per Upsert in die DB
  migriert (kein manueller Eingriff nötig)
- management-ui: /users-Seite mit Tabelle, Anlegen-, Bearbeiten-,
  Passwort-setzen- und Löschen-Modals; "You"-Badge für eigenen Account
- Sidebar + Route + i18n (de/en) ergänzt

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/handlers/users.go

@@ -0,0 +1,166 @@
+package handlers
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
+)
+
+// UsersHandler exposes:
+//
+//	GET    /api/v1/users           — list all users
+//	POST   /api/v1/users           — create user
+//	PUT    /api/v1/users/:id       — update email/role/active (not password)
+//	POST   /api/v1/users/:id/password — set new password
+//	DELETE /api/v1/users/:id       — delete user
+type UsersHandler struct {
+	Repo   *users.Repo
+	Audit  *audit.Repo
+	NodeID string
+}
+
+func NewUsersHandler(repo *users.Repo, a *audit.Repo, nodeID string) *UsersHandler {
+	return &UsersHandler{Repo: repo, Audit: a, NodeID: nodeID}
+}
+
+func (h *UsersHandler) Register(rg *gin.RouterGroup) {
+	g := rg.Group("/users")
+	g.GET("", h.List)
+	g.POST("", h.Create)
+	g.PUT("/:id", h.Update)
+	g.POST("/:id/password", h.SetPassword)
+	g.DELETE("/:id", h.Delete)
+}
+
+func (h *UsersHandler) List(c *gin.Context) {
+	out, err := h.Repo.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	if out == nil {
+		out = []users.User{}
+	}
+	response.OK(c, gin.H{"users": out})
+}
+
+type createUserReq struct {
+	Email    string `json:"email"    binding:"required,email"`
+	Password string `json:"password" binding:"required,min=12"`
+	Role     string `json:"role"     binding:"required,oneof=admin viewer"`
+	Active   bool   `json:"active"`
+}
+
+func (h *UsersHandler) Create(c *gin.Context) {
+	var req createUserReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	u, err := h.Repo.Create(c.Request.Context(), req.Email, req.Password, req.Role, req.Active)
+	if errors.Is(err, users.ErrEmailTaken) {
+		response.Err(c, http.StatusConflict, err)
+		return
+	}
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.create", u.Email,
+		gin.H{"role": u.Role, "active": u.Active}, h.NodeID)
+	response.Created(c, u)
+}
+
+type updateUserReq struct {
+	Email  string `json:"email"  binding:"required,email"`
+	Role   string `json:"role"   binding:"required,oneof=admin viewer"`
+	Active bool   `json:"active"`
+}
+
+func (h *UsersHandler) Update(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req updateUserReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	u, err := h.Repo.Update(c.Request.Context(), id, req.Email, req.Role, req.Active)
+	if errors.Is(err, users.ErrNotFound) {
+		response.NotFound(c, err)
+		return
+	}
+	if errors.Is(err, users.ErrEmailTaken) {
+		response.Err(c, http.StatusConflict, err)
+		return
+	}
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.update", u.Email,
+		gin.H{"role": u.Role, "active": u.Active}, h.NodeID)
+	response.OK(c, u)
+}
+
+type setPasswordReq struct {
+	Password string `json:"password" binding:"required,min=12"`
+}
+
+func (h *UsersHandler) SetPassword(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req setPasswordReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if err := h.Repo.SetPassword(c.Request.Context(), id, req.Password); err != nil {
+		if errors.Is(err, users.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.password.set",
+		c.Param("id"), nil, h.NodeID)
+	response.OK(c, gin.H{"ok": true})
+}
+
+func (h *UsersHandler) Delete(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	// Prevent deleting the own account.
+	tok := CurrentToken(c)
+	if tok != nil {
+		if u, _, err := h.Repo.FindByEmail(c.Request.Context(), tok.Actor); err == nil {
+			if u.ID == id {
+				response.Err(c, http.StatusBadRequest, errors.New("cannot delete own account"))
+				return
+			}
+		}
+	}
+	if err := h.Repo.Delete(c.Request.Context(), id); err != nil {
+		if errors.Is(err, users.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.delete",
+		c.Param("id"), nil, h.NodeID)
+	response.OK(c, gin.H{"ok": true})
+}