feat(users): Multi-User-Management — DB-backed Login-Accounts + UI

- internal/services/users: Repo mit CRUD, bcrypt (cost 12), Upsert für
  setup-store-Admin-Migration, RecordLogin
- internal/handlers/users: GET/POST/PUT /users, POST /users/:id/password,
  DELETE /users/:id; Schutz gegen Selbst-Löschung
- auth.go Login: DB-Nutzer first, Fallback auf setup-store-Admin;
  bei erfolgreichem Fallback wird der Admin per Upsert in die DB
  migriert (kein manueller Eingriff nötig)
- management-ui: /users-Seite mit Tabelle, Anlegen-, Bearbeiten-,
  Passwort-setzen- und Löschen-Modals; "You"-Badge für eigenen Account
- Sidebar + Route + i18n (de/en) ergänzt

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

management-ui/src/i18n/locales/en/common.json

@@ -23,6 +23,7 @@
     "audit": "Audit log",
     "backups": "Backups",
     "diagnostics": "Diagnostics",
+    "users": "Users",
     "alerts": "Alerts",
     "license": "License",
     "settings": "Settings",
@@ -1136,6 +1137,29 @@
       "rule": "Rule ID"
     }
   },
+  "users": {
+    "title": "User Management",
+    "intro": "Manage login accounts. Every account listed here can authenticate via the login page.",
+    "addUser": "Add User",
+    "editUser": "Edit User",
+    "email": "Email",
+    "role": "Role",
+    "active": "Active",
+    "lastLogin": "Last Login",
+    "created": "Created",
+    "setPassword": "Set Password",
+    "setPasswordTitle": "Set New Password",
+    "newPassword": "New Password",
+    "newPasswordHint": "Minimum 12 characters.",
+    "roleAdmin": "Admin",
+    "roleViewer": "Viewer (read-only)",
+    "deleteConfirm": "Delete user {{email}}? This cannot be undone.",
+    "emptyTitle": "No users yet",
+    "emptyDesc": "Add the first additional user above.",
+    "errorEmailTaken": "This email address is already in use.",
+    "cannotDeleteSelf": "You cannot delete your own account.",
+    "never": "Never"
+  },
   "audit": {
     "title": "Audit log",
     "intro": "Who changed what, when. Every mutation through the API (domain create, backend disable, cert issue, …) is recorded here.",