admin: user management, invites, password reset, audit log

Add /admin/users to create, edit, disable and delete accounts with the
per-area permission grid. New users get a one-time invite link (48 h)
by email; the admin also sees it once, so an account without email can
still be onboarded. Forgotten passwords get a 1 h reset link with the
same answer for unknown accounts. Only token hashes are stored.

Guards against escalation and lockout: a user manager can only grant
flags they hold and cannot touch flags they lack; only superusers change
superuser accounts; nobody can disable or delete themselves; the last
active superuser stays.

Logins, user changes, and bingo and invoice actions are recorded in an
audit log at /admin/audit.

Read timestamps as UTC: they are all written with Time.now.utc, and on a
UTC+4 host a fresh 1 h token read back as already expired.

Assisted-by: Claude:opus-5

lib/db.rb

@@ -4,6 +4,9 @@ module DB
   module_function
 
   def connect!
+    # Every timestamp is written as Time.now.utc; read them back as UTC too
+    # (otherwise a host in UTC+4 sees a fresh 1 h token as already expired).
+    Sequel.default_timezone = :utc
     @connection ||= Sequel.connect(
       ENV.fetch('DATABASE_URL'),
       max_connections: 5,