admin: user management, invites, password reset, audit log

Add /admin/users to create, edit, disable and delete accounts with the
per-area permission grid. New users get a one-time invite link (48 h)
by email; the admin also sees it once, so an account without email can
still be onboarded. Forgotten passwords get a 1 h reset link with the
same answer for unknown accounts. Only token hashes are stored.

Guards against escalation and lockout: a user manager can only grant
flags they hold and cannot touch flags they lack; only superusers change
superuser accounts; nobody can disable or delete themselves; the last
active superuser stays.

Logins, user changes, and bingo and invoice actions are recorded in an
audit log at /admin/audit.

Read timestamps as UTC: they are all written with Time.now.utc, and on a
UTC+4 host a fresh 1 h token read back as already expired.

Assisted-by: Claude:opus-5

views/admin/audit.erb

@@ -0,0 +1,23 @@
+<%== erb :'admin/_nav', layout: false %>
+<div class="header">
+    <h1>Audit log</h1>
+    <p class="tagline"><a href="/admin/users">← users</a> · last <%= @entries.size %> entries</p>
+</div>
+
+<section class="section">
+    <table class="invoice-list">
+        <thead><tr><th>Time (UTC)</th><th>User</th><th>Action</th><th>Target</th><th>Detail</th><th>IP</th></tr></thead>
+        <tbody>
+            <% @entries.each do |e| %>
+                <tr>
+                    <td class="mono"><%= e[:created_at].strftime('%Y-%m-%d %H:%M') %></td>
+                    <td><%= e[:username] || '—' %></td>
+                    <td class="mono"><%= e[:action] %></td>
+                    <td><%= e[:target] %></td>
+                    <td class="optional"><%= e[:detail] %></td>
+                    <td class="mono optional"><%= e[:ip] %></td>
+                </tr>
+            <% end %>
+        </tbody>
+    </table>
+</section>