feat: add admin user management with role-based access and self-protection

- Add AdminRequired middleware for admin-role routes
- Add login status check to reject disabled/locked accounts
- Add CRUD handlers (list, create, edit, delete) for users
- Add user_list and user_form templates with role/status badges
- Add nav entry and dashboard button for user management
- Add dynamic user count on admin dashboard
- Fix userIDFromSession to handle all numeric session types
- Self-protection: cannot delete/disable self or demote last admin
- Add EN/ZH i18n keys for all user management strings

handlers/admin.go

@@ -25,6 +25,11 @@ func AdminDashboard(db *gorm.DB) gin.HandlerFunc {
 		data["PostCount"] = postCount
 		data["PublishedCount"] = publishedCount
 
+		// User count for the stats card.
+		var userCount int64
+		db.Model(&models.User{}).Count(&userCount)
+		data["UserCount"] = userCount
+
 		c.HTML(http.StatusOK, "dashboard", data)
 	}
 }