admin: user management, invites, password reset, audit log

Add /admin/users to create, edit, disable and delete accounts with the
per-area permission grid. New users get a one-time invite link (48 h)
by email; the admin also sees it once, so an account without email can
still be onboarded. Forgotten passwords get a 1 h reset link with the
same answer for unknown accounts. Only token hashes are stored.

Guards against escalation and lockout: a user manager can only grant
flags they hold and cannot touch flags they lack; only superusers change
superuser accounts; nobody can disable or delete themselves; the last
active superuser stays.

Logins, user changes, and bingo and invoice actions are recorded in an
audit log at /admin/audit.

Read timestamps as UTC: they are all written with Time.now.utc, and on a
UTC+4 host a fresh 1 h token read back as already expired.

Assisted-by: Claude:opus-5

db/migrations/008_user_tokens_audit.rb

@@ -0,0 +1,27 @@
+Sequel.migration do
+  change do
+    # One-time invite / password-reset links. Only a SHA-256 of the token
+    # is stored; the raw token exists in the email and the URL.
+    create_table(:user_tokens) do
+      primary_key :id
+      foreign_key :user_id, :users, null: false, on_delete: :cascade
+      String   :purpose,      null: false # invite | reset
+      String   :token_digest, null: false, unique: true
+      DateTime :expires_at,   null: false
+      DateTime :used_at
+      DateTime :created_at,   null: false
+    end
+
+    create_table(:audit_log) do
+      primary_key :id
+      foreign_key :user_id, :users, on_delete: :set_null
+      String   :username            # kept after the user is deleted
+      String   :action,  null: false
+      String   :target
+      String   :detail,  text: true
+      String   :ip
+      DateTime :created_at, null: false
+      index :created_at
+    end
+  end
+end