feat(auth): user management UI in Settings + GET /api/auth/users

- New: GET /api/auth/users (admin only) returns [{id, email, name, role, is_active}]
- New: 'User Management' card in Settings page
  - Lists all users with role badge (admin/user) and inactive indicator
  - 'Reset Password' button per user
  - Modal: enter new password (>=6 chars), confirm/cancel
  - Toast success / inline error
  - Esc closes modal, click backdrop closes
  - ESC + Enter shortcuts
  - Non-admin (or 403) shows empty state

backend/main.py

@@ -305,6 +305,25 @@ async def reset_password(
         "reset_by": current_user.email,
     }
 
+
+@app.get("/api/auth/users")
+async def list_users(
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_admin),
+):
+    """Admin-only: list all users (id, email, name, role, is_active)."""
+    users = db.query(User).order_by(User.id.asc()).all()
+    return [
+        {
+            "id": u.id,
+            "email": u.email,
+            "name": u.name,
+            "role": u.role,
+            "is_active": u.is_active,
+        }
+        for u in users
+    ]
+
 # ============ Excel File Storage ============
 def get_excel_path(section: str) -> str:
     """Get path to the stored Excel file for a section"""