admin: user management, invites, password reset, audit log

Add /admin/users to create, edit, disable and delete accounts with the
per-area permission grid. New users get a one-time invite link (48 h)
by email; the admin also sees it once, so an account without email can
still be onboarded. Forgotten passwords get a 1 h reset link with the
same answer for unknown accounts. Only token hashes are stored.

Guards against escalation and lockout: a user manager can only grant
flags they hold and cannot touch flags they lack; only superusers change
superuser accounts; nobody can disable or delete themselves; the last
active superuser stays.

Logins, user changes, and bingo and invoice actions are recorded in an
audit log at /admin/audit.

Read timestamps as UTC: they are all written with Time.now.utc, and on a
UTC+4 host a fresh 1 h token read back as already expired.

Assisted-by: Claude:opus-5

lib/user.rb

@@ -85,3 +85,30 @@ class UserPermission < Sequel::Model(:user_permissions)
   unrestrict_primary_key
   many_to_one :user
 end
+
+# One-time invite / reset links; see migration 008.
+class UserToken < Sequel::Model(:user_tokens)
+  TTL = { 'invite' => 48 * 3600, 'reset' => 3600 }.freeze
+
+  many_to_one :user
+
+  def self.digest(raw) = OpenSSL::Digest::SHA256.hexdigest(raw.to_s)
+
+  # Returns the raw token; earlier unused tokens of the same purpose die.
+  def self.issue!(user, purpose)
+    where(user_id: user.id, purpose: purpose, used_at: nil).delete
+    raw = SecureRandom.urlsafe_base64(32)
+    create(user_id: user.id, purpose: purpose, token_digest: digest(raw),
+           expires_at: Time.now.utc + TTL.fetch(purpose), created_at: Time.now.utc)
+    raw
+  end
+
+  def self.find_valid(raw, purpose)
+    t = self[token_digest: digest(raw), purpose: purpose]
+    t if t && t.used_at.nil? && t.expires_at > Time.now && t.user&.active
+  end
+
+  def use!
+    update(used_at: Time.now.utc)
+  end
+end