feat: admin dashboard for user management

Adds an /admin route, visible only to users with role=admin, that lets an
operator manage the user base from the UI:
- list / search users (active + inactive)
- create new accounts (with role and optional display name)
- reset a user's password
- promote/demote between admin and member
- deactivate / reactivate (soft-delete via is_active flag)

Backend changes:
- New adminOrApiKeyMiddleware accepts EITHER a Bearer JWT belonging to a
  role=admin user (UI path) OR the existing X-API-Key (bot/server-to-server).
- Existing /api/admin/* routes switched to the hybrid middleware, so the same
  endpoints serve both the dashboard and any external scripts.
- Added PUT /api/admin/users/:id/role and PUT /api/admin/users/:id/reactivate.
- Self-deactivation and self-demotion are explicitly blocked so an admin can't
  lock themselves out.

Frontend changes:
- New Admin.tsx page (table view, modals for create + reset, toast feedback).
- Admin button in CollectionList header, only rendered for admin role.
- Wired into App.tsx routing.

Also: friendly error when poppler-utils is missing on the host (PDF uploads
return 501 POPPLER_MISSING with a one-line install hint instead of crashing
the request); README clarifies poppler is required for the manual install.

backend/routes/upload.js

@@ -250,6 +250,10 @@ router.post('/boards/:boardId/images', upload.single('image'), async (req, res)
     if (err.code === 'LIMIT_FILE_SIZE') {
       return res.status(413).json({ error: `File too large (max ${MAX_FILE_SIZE_LABEL})` });
     }
+    if (err.code === 'POPPLER_MISSING') {
+      console.error('[upload] poppler-utils missing — PDF support disabled until host installs it');
+      return res.status(err.statusCode || 501).json({ error: err.message, code: err.code });
+    }
     console.error('[upload] error:', err);
     return res.status(500).json({ error: 'Internal server error' });
   }