Add Back Office user queries and account control actions

[yacosta738]

Context

Back Office needs operational visibility over registered accounts plus a safe set of initial control actions. This should start with list/search/detail access and explicit account control commands rather than broad mutable user editing.

Goal

Implement user administration queries and the initial account control actions: disable account, enable account, and revoke sessions.

Scope

• List and search users.
• View user detail with account state, verification state, registration timestamp, and workspace memberships.
• Disable account.
• Enable account.
• Revoke active sessions.
• Record administrative audit events for mutations.

Out of Scope

• Email changes.
• Account deletion.
• Ownership transfer.
• Impersonation.
• Manual email verification.

Domain Rules

• Account status should be modeled as administrative state, not unrelated booleans.
• A disabled account cannot authenticate or refresh sessions.
• Disabling an account should revoke active refresh sessions.

API Contract

• Prefer explicit commands such as POST /api/admin/users/{id}/disable, POST /api/admin/users/{id}/enable, and POST /api/admin/users/{id}/sessions/revoke.
• Query endpoints should support operational search and detail access.

Security

• Requires explicit administrative authorization.
• Dangerous actions must be server-side validated and auditable.

Audit

• Emit USER_DISABLED, USER_ENABLED, and USER_SESSIONS_REVOKED audit events.

Observability

• Track disable/enable/revoke counts and failed authorization attempts.

Acceptance Criteria

1. Administrators can list and search users.
2. Administrators can inspect key operational user details.
3. Administrators can disable and re-enable accounts.
4. Administrators can revoke all active sessions for a user.
5. Account control mutations are audited.

Gherkin

Feature: User administration

  Scenario: Disable user
    Given an active user exists
    When an authorized administrator disables the user
    Then the account should become disabled
    And active refresh sessions should be revoked

  Scenario: Revoke all sessions
    Given a user has sessions on multiple devices
    When an administrator revokes all sessions
    Then every refresh session should become invalid

Testing

• Unit
• Application
• API
• Integration
• Security

Dependencies

• Establish administrative authorization boundary for Back Office APIs #659
• Implement administrative audit event infrastructure #657

References

• RFC sections 21, 22, 23, 36, 37, 45

[linear-code]

DALLAY-572