admin: user management, invites, password reset, audit log

Add /admin/users to create, edit, disable and delete accounts with the
per-area permission grid. New users get a one-time invite link (48 h)
by email; the admin also sees it once, so an account without email can
still be onboarded. Forgotten passwords get a 1 h reset link with the
same answer for unknown accounts. Only token hashes are stored.

Guards against escalation and lockout: a user manager can only grant
flags they hold and cannot touch flags they lack; only superusers change
superuser accounts; nobody can disable or delete themselves; the last
active superuser stays.

Logins, user changes, and bingo and invoice actions are recorded in an
audit log at /admin/audit.

Read timestamps as UTC: they are all written with Time.now.utc, and on a
UTC+4 host a fresh 1 h token read back as already expired.

Assisted-by: Claude:opus-5

views/admin/reset_request.erb

@@ -0,0 +1,16 @@
+<div class="header">
+    <h1>Reset password</h1>
+    <p class="tagline"><a href="/admin/login">← log in</a></p>
+</div>
+
+<section class="section">
+    <% if @sent %>
+        <p>If an account with an email address matches, a reset link is on its way. It works once and expires in 1 hour.</p>
+    <% else %>
+        <form class="invoice-form auth-form" method="post" action="/admin/reset">
+            <input type="hidden" name="authenticity_token" value="<%= csrf_token %>" />
+            <div class="field"><label for="login">Username or email</label><input type="text" id="login" name="login" autocomplete="username" autocapitalize="none" required autofocus /></div>
+            <button type="submit" class="download-button">Send reset link</button>
+        </form>
+    <% end %>
+</section>