Implement admin users and roles management

- Add user CRUD: list, create (via Better Auth), update role/status, remove from port
- Add role CRUD: create, update permissions, delete with system role protection
- Full permissions matrix UI with accordion groups and per-action checkboxes
- Validators, services, API routes, and UI components following existing patterns

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/lib/validators/users.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+
+export const createUserSchema = z.object({
+  email: z.string().email(),
+  name: z.string().min(1).max(200),
+  password: z.string().min(12),
+  displayName: z.string().min(1).max(200),
+  phone: z.string().optional(),
+  roleId: z.string().uuid(),
+});
+
+export type CreateUserInput = z.infer<typeof createUserSchema>;
+
+export const updateUserSchema = z.object({
+  displayName: z.string().min(1).max(200).optional(),
+  phone: z.string().nullable().optional(),
+  isActive: z.boolean().optional(),
+  roleId: z.string().uuid().optional(),
+});
+
+export type UpdateUserInput = z.infer<typeof updateUserSchema>;
+
+export const resetPasswordSchema = z.object({
+  newPassword: z.string().min(12),
+});
+
+export type ResetPasswordInput = z.infer<typeof resetPasswordSchema>;