feat(admin-console): Stage 3 — users domain

Add the operator console's user-administration pages over the existing
*user.Service (no new business logic).

- GET  /_gm/users            paginated account list
- GET  /_gm/users/{id}       account detail: profile, entitlement, sanctions
- POST /_gm/users/{id}/block        apply permanent_block (reason required)
- POST /_gm/users/{id}/entitlement  set the entitlement tier
- POST /_gm/users/{id}/soft-delete  soft-delete the account (cascades)

The console depends on a UserAdmin interface (satisfied by *user.Service) so the
pages render in tests without a database. All writes flow through the CSRF
guard, carry the operator as the audit actor, and answer with a 303 redirect;
a generic message page handles not-found, validation, and failure notices.
Unblock is intentionally absent — the admin API exposes no remove-sanction
endpoint.

Tests: list/detail render, not-found, block (with actor/scope/reason
assertions), missing-reason 400, bad-CSRF 403, entitlement, soft-delete
redirect, and the service-unavailable path.

Docs: backend/docs/admin-console.md gains the page inventory.

backend/internal/server/handlers_admin_console.go

@@ -28,6 +28,7 @@ type AdminConsoleHandlers struct {
 	assets   http.Handler
 	monitor  opsstatus.Reader
 	ready    func() bool
+	users    UserAdmin
 	logger   *zap.Logger
 }
 
@@ -41,6 +42,7 @@ type AdminConsoleDeps struct {
 	CSRF     *adminconsole.CSRF
 	Monitor  opsstatus.Reader
 	Ready    func() bool
+	Users    UserAdmin
 	Logger   *zap.Logger
 }
 
@@ -77,6 +79,7 @@ func NewAdminConsoleHandlers(deps AdminConsoleDeps) *AdminConsoleHandlers {
 		assets:   http.StripPrefix("/_gm/assets/", http.FileServer(http.FS(assetsFS))),
 		monitor:  deps.Monitor,
 		ready:    deps.Ready,
+		users:    deps.Users,
 		logger:   logger.Named("http.admin.console"),
 	}
 }
@@ -168,6 +171,17 @@ func (h *AdminConsoleHandlers) render(c *gin.Context, status int, page, activeNa
 	c.Data(status, "text/html; charset=utf-8", buf.Bytes())
 }
 
+// renderMessage renders the generic message page (not-found, validation, or
+// operation-failure notices). class selects the CSS styling and backHref, when
+// non-empty, adds a back link.
+func (h *AdminConsoleHandlers) renderMessage(c *gin.Context, status int, activeNav, title, message, class, backHref string) {
+	h.render(c, status, "message", activeNav, title, adminconsole.MessageData{
+		Message:  message,
+		Class:    class,
+		BackHref: backHref,
+	})
+}
+
 // isSafeHTTPMethod reports whether method is a read-only HTTP method that the
 // CSRF guard may let through without a token.
 func isSafeHTTPMethod(method string) bool {