feat: admin dashboard for user management

Adds an /admin route, visible only to users with role=admin, that lets an
operator manage the user base from the UI:
- list / search users (active + inactive)
- create new accounts (with role and optional display name)
- reset a user's password
- promote/demote between admin and member
- deactivate / reactivate (soft-delete via is_active flag)

Backend changes:
- New adminOrApiKeyMiddleware accepts EITHER a Bearer JWT belonging to a
  role=admin user (UI path) OR the existing X-API-Key (bot/server-to-server).
- Existing /api/admin/* routes switched to the hybrid middleware, so the same
  endpoints serve both the dashboard and any external scripts.
- Added PUT /api/admin/users/:id/role and PUT /api/admin/users/:id/reactivate.
- Self-deactivation and self-demotion are explicitly blocked so an admin can't
  lock themselves out.

Frontend changes:
- New Admin.tsx page (table view, modals for create + reset, toast feedback).
- Admin button in CollectionList header, only rendered for admin role.
- Wired into App.tsx routing.

Also: friendly error when poppler-utils is missing on the host (PDF uploads
return 501 POPPLER_MISSING with a one-line install hint instead of crashing
the request); README clarifies poppler is required for the manual install.

backend/auth.js

@@ -81,6 +81,38 @@ function apiKeyMiddleware(req, res, next) {
   next();
 }
 
+/**
+ * Express middleware: accepts EITHER a valid X-API-Key (server-to-server / bot)
+ * OR a Bearer JWT belonging to a user with role=admin (UI dashboard).
+ *
+ * On JWT path: attaches decoded user to req.user.
+ */
+function adminOrApiKeyMiddleware(req, res, next) {
+  const apiKey = req.headers['x-api-key'];
+  if (apiKey && REFBOARD_API_KEY && apiKey === REFBOARD_API_KEY) {
+    return next();
+  }
+
+  const authHeader = req.headers.authorization;
+  if (authHeader && authHeader.startsWith('Bearer ')) {
+    try {
+      const decoded = verifyToken(authHeader.slice(7));
+      if (decoded.role !== 'admin') {
+        return res.status(403).json({ error: 'Admin access required' });
+      }
+      req.user = decoded;
+      return next();
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+  }
+
+  return res.status(401).json({ error: 'Admin authentication required' });
+}
+
 module.exports = {
   generateToken,
   verifyToken,
@@ -89,5 +121,6 @@ module.exports = {
   authMiddleware,
   adminMiddleware,
   apiKeyMiddleware,
+  adminOrApiKeyMiddleware,
   JWT_SECRET,
 };