feat(users): Multi-User-Management — DB-backed Login-Accounts + UI

- internal/services/users: Repo mit CRUD, bcrypt (cost 12), Upsert für
  setup-store-Admin-Migration, RecordLogin
- internal/handlers/users: GET/POST/PUT /users, POST /users/:id/password,
  DELETE /users/:id; Schutz gegen Selbst-Löschung
- auth.go Login: DB-Nutzer first, Fallback auf setup-store-Admin;
  bei erfolgreichem Fallback wird der Admin per Upsert in die DB
  migriert (kein manueller Eingriff nötig)
- management-ui: /users-Seite mit Tabelle, Anlegen-, Bearbeiten-,
  Passwort-setzen- und Löschen-Modals; "You"-Badge für eigenen Account
- Sidebar + Route + i18n (de/en) ergänzt

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

management-ui/src/App.tsx

@@ -36,6 +36,7 @@ const DiagnosticsPage = lazy(() => import('./pages/Diagnostics'))
 const AlertsPage = lazy(() => import('./pages/Alerts'))
 const LicensePage = lazy(() => import('./pages/License'))
 const SettingsPage = lazy(() => import('./pages/Settings'))
+const UsersPage = lazy(() => import('./pages/Users'))
 
 const queryClient = new QueryClient({
   defaultOptions: {
@@ -128,6 +129,7 @@ export default function App() {
                   <Route path="/diagnostics" element={<DiagnosticsPage />} />
                   <Route path="/alerts" element={<AlertsPage />} />
                   <Route path="/license" element={<LicensePage />} />
+                  <Route path="/users" element={<UsersPage />} />
                   <Route path="/settings" element={<SettingsPage />} />
                 </Route>
 

management-ui/src/components/Layout/AppLayout.tsx

@@ -26,6 +26,7 @@ const PAGE_TITLES: Record<string, string> = {
   '/diagnostics':   'nav.diagnostics',
   '/alerts':        'nav.alerts',
   '/license':       'nav.license',
+  '/users':         'nav.users',
   '/settings':      'nav.settings',
 }
 

management-ui/src/components/Layout/Sidebar.tsx

@@ -20,6 +20,7 @@ import {
   NodeIndexOutlined,
   SafetyCertificateOutlined,
   SettingOutlined,
+  TeamOutlined,
   ThunderboltOutlined,
   ToolOutlined,
 } from '@ant-design/icons'
@@ -85,6 +86,7 @@ const NAV: NavSection[] = [
       { path: '/alerts',   labelKey: 'nav.alerts',   icon: <BellOutlined /> },
       { path: '/backups',  labelKey: 'nav.backups',  icon: <DatabaseOutlined /> },
       { path: '/license',  labelKey: 'nav.license',  icon: <CrownOutlined /> },
+      { path: '/users',    labelKey: 'nav.users',    icon: <TeamOutlined /> },
       { path: '/settings', labelKey: 'nav.settings', icon: <SettingOutlined /> },
     ],
   },

management-ui/src/i18n/locales/de/common.json

@@ -23,6 +23,7 @@
     "audit": "Audit-Log",
     "backups": "Backups",
     "diagnostics": "Diagnose",
+    "users": "Benutzer",
     "alerts": "Alarme",
     "license": "Lizenz",
     "settings": "Einstellungen",
@@ -1136,6 +1137,29 @@
       "rule": "Rule-ID"
     }
   },
+  "users": {
+    "title": "Benutzerverwaltung",
+    "intro": "Login-Accounts verwalten. Alle hier gelisteten Accounts können sich über die Login-Seite authentifizieren.",
+    "addUser": "Benutzer anlegen",
+    "editUser": "Benutzer bearbeiten",
+    "email": "E-Mail",
+    "role": "Rolle",
+    "active": "Aktiv",
+    "lastLogin": "Letzter Login",
+    "created": "Angelegt",
+    "setPassword": "Passwort setzen",
+    "setPasswordTitle": "Neues Passwort setzen",
+    "newPassword": "Neues Passwort",
+    "newPasswordHint": "Mindestens 12 Zeichen.",
+    "roleAdmin": "Admin",
+    "roleViewer": "Betrachter (nur lesen)",
+    "deleteConfirm": "Benutzer {{email}} löschen? Dies kann nicht rückgängig gemacht werden.",
+    "emptyTitle": "Noch keine Benutzer",
+    "emptyDesc": "Oben den ersten zusätzlichen Benutzer anlegen.",
+    "errorEmailTaken": "Diese E-Mail-Adresse wird bereits verwendet.",
+    "cannotDeleteSelf": "Das eigene Konto kann nicht gelöscht werden.",
+    "never": "Nie"
+  },
   "audit": {
     "title": "Audit-Log",
     "intro": "Wer hat was wann geändert. Jede Mutation in der API (Domain anlegen, Backend deaktivieren, Cert ausstellen, …) ist hier nachvollziehbar.",

management-ui/src/i18n/locales/en/common.json

@@ -23,6 +23,7 @@
     "audit": "Audit log",
     "backups": "Backups",
     "diagnostics": "Diagnostics",
+    "users": "Users",
     "alerts": "Alerts",
     "license": "License",
     "settings": "Settings",
@@ -1136,6 +1137,29 @@
       "rule": "Rule ID"
     }
   },
+  "users": {
+    "title": "User Management",
+    "intro": "Manage login accounts. Every account listed here can authenticate via the login page.",
+    "addUser": "Add User",
+    "editUser": "Edit User",
+    "email": "Email",
+    "role": "Role",
+    "active": "Active",
+    "lastLogin": "Last Login",
+    "created": "Created",
+    "setPassword": "Set Password",
+    "setPasswordTitle": "Set New Password",
+    "newPassword": "New Password",
+    "newPasswordHint": "Minimum 12 characters.",
+    "roleAdmin": "Admin",
+    "roleViewer": "Viewer (read-only)",
+    "deleteConfirm": "Delete user {{email}}? This cannot be undone.",
+    "emptyTitle": "No users yet",
+    "emptyDesc": "Add the first additional user above.",
+    "errorEmailTaken": "This email address is already in use.",
+    "cannotDeleteSelf": "You cannot delete your own account.",
+    "never": "Never"
+  },
   "audit": {
     "title": "Audit log",
     "intro": "Who changed what, when. Every mutation through the API (domain create, backend disable, cert issue, …) is recorded here.",

management-ui/src/pages/Users/index.tsx

@@ -0,0 +1,247 @@
+import { useState } from 'react'
+import {
+  Button, Form, Input, Modal, Select, Space, Switch, Tag, Tooltip, Typography, message,
+} from 'antd'
+import type { ColumnsType } from 'antd/es/table'
+import { KeyOutlined, PlusOutlined, TeamOutlined } from '@ant-design/icons'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+
+import apiClient, { isEnvelope } from '../../api/client'
+import { useAuthStore } from '../../stores/auth'
+import PageHeader from '../../components/PageHeader'
+import DataTable from '../../components/DataTable'
+import EmptyState from '../../components/EmptyState'
+import ActionButtons from '../../components/ActionButtons'
+import StatusDot from '../../components/StatusDot'
+
+const { Text } = Typography
+
+interface User {
+  id: number
+  email: string
+  role: string
+  active: boolean
+  last_login_at: string | null
+  created_at: string
+}
+
+interface CreateValues { email: string; password: string; role: string; active: boolean }
+interface EditValues   { email: string; role: string; active: boolean }
+interface PwValues     { password: string }
+
+async function listUsers(): Promise<User[]> {
+  const r = await apiClient.get('/users')
+  if (!isEnvelope(r.data)) return []
+  return (r.data.data as { users?: User[] }).users ?? []
+}
+
+const ROLE_COLORS: Record<string, string> = { admin: 'blue', viewer: 'default' }
+
+export default function UsersPage() {
+  const { t } = useTranslation()
+  const qc = useQueryClient()
+  const me = useAuthStore((s) => s.user)
+
+  const { data: users, isLoading } = useQuery({ queryKey: ['users'], queryFn: listUsers })
+
+  const [creating, setCreating]   = useState(false)
+  const [editing, setEditing]     = useState<User | null>(null)
+  const [pwTarget, setPwTarget]   = useState<User | null>(null)
+  const [createForm] = Form.useForm<CreateValues>()
+  const [editForm]   = Form.useForm<EditValues>()
+  const [pwForm]     = Form.useForm<PwValues>()
+
+  const invalidate = () => void qc.invalidateQueries({ queryKey: ['users'] })
+
+  const createMut = useMutation({
+    mutationFn: (v: CreateValues) => apiClient.post('/users', v),
+    onSuccess: () => { message.success(t('common.save')); setCreating(false); createForm.resetFields(); invalidate() },
+    onError: (e: Error) => message.error(e.message),
+  })
+  const updateMut = useMutation({
+    mutationFn: ({ id, v }: { id: number; v: EditValues }) => apiClient.put(`/users/${id}`, v),
+    onSuccess: () => { message.success(t('common.save')); setEditing(null); editForm.resetFields(); invalidate() },
+    onError: (e: Error) => message.error(e.message),
+  })
+  const pwMut = useMutation({
+    mutationFn: ({ id, v }: { id: number; v: PwValues }) => apiClient.post(`/users/${id}/password`, v),
+    onSuccess: () => { message.success(t('common.save')); setPwTarget(null); pwForm.resetFields() },
+    onError: (e: Error) => message.error(e.message),
+  })
+  const delMut = useMutation({
+    mutationFn: (id: number) => apiClient.delete(`/users/${id}`),
+    onSuccess: invalidate,
+    onError: (e: Error) => message.error(e.message),
+  })
+
+  const roleOptions = [
+    { value: 'admin',  label: t('users.roleAdmin') },
+    { value: 'viewer', label: t('users.roleViewer') },
+  ]
+
+  const columns: ColumnsType<User> = [
+    {
+      title: t('users.email'), dataIndex: 'email', key: 'email',
+      render: (s: string, row) => (
+        <Space size={6}>
+          <span>{s}</span>
+          {me?.actor === s && <Tag style={{ fontSize: 11, padding: '0 4px' }}>You</Tag>}
+        </Space>
+      ),
+    },
+    {
+      title: t('users.role'), dataIndex: 'role', key: 'role',
+      render: (r: string) => (
+        <Tag color={ROLE_COLORS[r] ?? 'default'}>
+          {r === 'admin' ? t('users.roleAdmin') : t('users.roleViewer')}
+        </Tag>
+      ),
+    },
+    {
+      title: t('users.active'), dataIndex: 'active', key: 'active', width: 70,
+      render: (v: boolean) => <StatusDot active={v} />,
+    },
+    {
+      title: t('users.lastLogin'), key: 'lastLogin', width: 160,
+      render: (_, row) => row.last_login_at
+        ? <Tooltip title={new Date(row.last_login_at).toLocaleString()}>
+            <Text type="secondary" style={{ fontSize: 12 }}>
+              {new Date(row.last_login_at).toLocaleDateString()}
+            </Text>
+          </Tooltip>
+        : <Text type="secondary" style={{ fontSize: 12 }}>{t('users.never')}</Text>,
+    },
+    {
+      title: t('common.actions'), key: 'actions', width: 120,
+      render: (_, row) => (
+        <Space size={4}>
+          <Tooltip title={t('users.setPassword')}>
+            <Button type="text" size="small" icon={<KeyOutlined />}
+              onClick={() => { setPwTarget(row); pwForm.resetFields() }} />
+          </Tooltip>
+          <ActionButtons
+            onEdit={() => {
+              setEditing(row)
+              editForm.setFieldsValue({ email: row.email, role: row.role, active: row.active })
+            }}
+            onDelete={() => delMut.mutate(row.id)}
+            deleteConfirm={t('users.deleteConfirm', { email: row.email })}
+          />
+        </Space>
+      ),
+    },
+  ]
+
+  return (
+    <div>
+      <PageHeader
+        icon={<TeamOutlined />}
+        title={t('users.title')}
+        subtitle={t('users.intro')}
+      />
+
+      <DataTable
+        rowKey="id"
+        loading={isLoading}
+        dataSource={users ?? []}
+        columns={columns}
+        extraActions={
+          <Button type="primary" icon={<PlusOutlined />} onClick={() => {
+            setCreating(true)
+            createForm.resetFields()
+            createForm.setFieldsValue({ role: 'admin', active: true })
+          }}>
+            {t('users.addUser')}
+          </Button>
+        }
+        emptyContent={
+          <EmptyState
+            icon={<TeamOutlined />}
+            title={t('users.emptyTitle')}
+            description={t('users.emptyDesc')}
+            action={
+              <Button type="primary" icon={<PlusOutlined />} onClick={() => {
+                setCreating(true)
+                createForm.resetFields()
+                createForm.setFieldsValue({ role: 'admin', active: true })
+              }}>
+                {t('users.addUser')}
+              </Button>
+            }
+          />
+        }
+      />
+
+      {/* Create modal */}
+      <Modal
+        title={t('users.addUser')}
+        open={creating}
+        onCancel={() => { setCreating(false); createForm.resetFields() }}
+        onOk={() => void createForm.submit()}
+        confirmLoading={createMut.isPending}
+        destroyOnHidden
+      >
+        <Form form={createForm} layout="vertical"
+          onFinish={(v) => createMut.mutate(v)}>
+          <Form.Item label={t('users.email')} name="email" rules={[{ required: true, type: 'email' }]}>
+            <Input autoFocus autoComplete="off" />
+          </Form.Item>
+          <Form.Item label={t('users.newPassword')} name="password"
+            extra={t('users.newPasswordHint')}
+            rules={[{ required: true, min: 12, message: t('users.newPasswordHint') }]}>
+            <Input.Password autoComplete="new-password" />
+          </Form.Item>
+          <Form.Item label={t('users.role')} name="role" rules={[{ required: true }]}>
+            <Select options={roleOptions} />
+          </Form.Item>
+          <Form.Item label={t('users.active')} name="active" valuePropName="checked">
+            <Switch />
+          </Form.Item>
+        </Form>
+      </Modal>
+
+      {/* Edit modal */}
+      <Modal
+        title={t('users.editUser')}
+        open={editing !== null}
+        onCancel={() => { setEditing(null); editForm.resetFields() }}
+        onOk={() => void editForm.submit()}
+        confirmLoading={updateMut.isPending}
+        destroyOnHidden
+      >
+        <Form form={editForm} layout="vertical"
+          onFinish={(v) => editing && updateMut.mutate({ id: editing.id, v })}>
+          <Form.Item label={t('users.email')} name="email" rules={[{ required: true, type: 'email' }]}>
+            <Input autoComplete="off" />
+          </Form.Item>
+          <Form.Item label={t('users.role')} name="role" rules={[{ required: true }]}>
+            <Select options={roleOptions} />
+          </Form.Item>
+          <Form.Item label={t('users.active')} name="active" valuePropName="checked">
+            <Switch />
+          </Form.Item>
+        </Form>
+      </Modal>
+
+      {/* Set password modal */}
+      <Modal
+        title={`${t('users.setPasswordTitle')} — ${pwTarget?.email ?? ''}`}
+        open={pwTarget !== null}
+        onCancel={() => { setPwTarget(null); pwForm.resetFields() }}
+        onOk={() => void pwForm.submit()}
+        confirmLoading={pwMut.isPending}
+        destroyOnHidden
+      >
+        <Form form={pwForm} layout="vertical"
+          onFinish={(v) => pwTarget && pwMut.mutate({ id: pwTarget.id, v })}>
+          <Form.Item label={t('users.newPassword')} name="password"
+            extra={t('users.newPasswordHint')}
+            rules={[{ required: true, min: 12, message: t('users.newPasswordHint') }]}>
+            <Input.Password autoFocus autoComplete="new-password" />
+          </Form.Item>
+        </Form>
+      </Modal>
+    </div>
+  )
+}