Add user management to admin dashboard and refine button specificity

- Implement admin user management interface (, , ) with async CRUD and password updating
- Add Users tab link to admin navigation across  and
- Use  in  to lower specificity for native button resets, allowing modifier classes like  to take precedence

inc/users.php

@@ -0,0 +1,72 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Admin user management helpers.
+ *
+ * Every read here explicitly selects columns and leaves password_hash
+ * out, so it can never accidentally end up in a JSON response or a
+ * data-* attribute the way a full row dump would.
+ */
+
+require_once __DIR__ . '/db.php';
+
+function get_all_users(): array {
+    $pdo = get_db();
+    $stmt = $pdo->query("SELECT id, username, role, created_at FROM users ORDER BY username ASC");
+    return $stmt->fetchAll() ?: [];
+}
+
+function get_user_by_id(int $id): ?array {
+    $pdo = get_db();
+    $stmt = $pdo->prepare("SELECT id, username, role, created_at FROM users WHERE id = ?");
+    $stmt->execute([$id]);
+    $res = $stmt->fetch();
+    return $res ?: null;
+}
+
+function count_users(): int {
+    $pdo = get_db();
+    return (int) $pdo->query("SELECT COUNT(*) FROM users")->fetchColumn();
+}
+
+function username_exists(string $username, ?int $excludeId = null): bool {
+    $pdo = get_db();
+    if ($excludeId !== null) {
+        $stmt = $pdo->prepare("SELECT 1 FROM users WHERE username = ? AND id != ?");
+        $stmt->execute([$username, $excludeId]);
+    } else {
+        $stmt = $pdo->prepare("SELECT 1 FROM users WHERE username = ?");
+        $stmt->execute([$username]);
+    }
+    return (bool) $stmt->fetchColumn();
+}
+
+function create_user(string $username, string $password, string $role): int {
+    $pdo = get_db();
+    $hash = password_hash($password, PASSWORD_DEFAULT);
+    $stmt = $pdo->prepare("INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)");
+    $stmt->execute([$username, $hash, $role]);
+    return (int) $pdo->lastInsertId();
+}
+
+function set_user_password(int $id, string $newPassword): bool {
+    $pdo = get_db();
+    $hash = password_hash($newPassword, PASSWORD_DEFAULT);
+    $stmt = $pdo->prepare("UPDATE users SET password_hash = ? WHERE id = ?");
+    return $stmt->execute([$hash, $id]);
+}
+
+function verify_user_password(int $id, string $password): bool {
+    $pdo = get_db();
+    $stmt = $pdo->prepare("SELECT password_hash FROM users WHERE id = ?");
+    $stmt->execute([$id]);
+    $hash = $stmt->fetchColumn();
+    return is_string($hash) && password_verify($password, $hash);
+}
+
+function delete_user(int $id): bool {
+    $pdo = get_db();
+    $stmt = $pdo->prepare("DELETE FROM users WHERE id = ?");
+    return $stmt->execute([$id]);
+}