admin: user management, invites, password reset, audit log

Add /admin/users to create, edit, disable and delete accounts with the
per-area permission grid. New users get a one-time invite link (48 h)
by email; the admin also sees it once, so an account without email can
still be onboarded. Forgotten passwords get a 1 h reset link with the
same answer for unknown accounts. Only token hashes are stored.

Guards against escalation and lockout: a user manager can only grant
flags they hold and cannot touch flags they lack; only superusers change
superuser accounts; nobody can disable or delete themselves; the last
active superuser stays.

Logins, user changes, and bingo and invoice actions are recorded in an
audit log at /admin/audit.

Read timestamps as UTC: they are all written with Time.now.utc, and on a
UTC+4 host a fresh 1 h token read back as already expired.

Assisted-by: Claude:opus-5

lib/mailer.rb

@@ -69,4 +69,33 @@ module Mailer
       body       body
     end
   end
+
+  # Invite / password-reset email with a one-time link.
+  def account_link(to:, username:, url:, kind:)
+    from = ENV.fetch('MAIL_FROM')
+    subj, intro, ttl =
+      if kind == 'invite'
+        ['Your asxp.io admin account', "An account \"#{username}\" was created for you on the asxp.io admin.\nSet your password here:", '48 hours']
+      else
+        ['Reset your asxp.io admin password', "Someone (hopefully you) asked to reset the password for \"#{username}\".\nSet a new one here:", '1 hour']
+      end
+    body = <<~BODY
+      #{intro}
+
+      #{url}
+
+      The link works once and expires in #{ttl}. If you didn't expect this
+      email, ignore it.
+
+      --
+      asxp.io
+    BODY
+
+    Mail.deliver do
+      from    from
+      to      to
+      subject subj
+      body    body
+    end
+  end
 end