feat: add admin user management with role-based access and self-protection

- Add AdminRequired middleware for admin-role routes
- Add login status check to reject disabled/locked accounts
- Add CRUD handlers (list, create, edit, delete) for users
- Add user_list and user_form templates with role/status badges
- Add nav entry and dashboard button for user management
- Add dynamic user count on admin dashboard
- Fix userIDFromSession to handle all numeric session types
- Self-protection: cannot delete/disable self or demote last admin
- Add EN/ZH i18n keys for all user management strings

handlers/auth.go

@@ -40,6 +40,12 @@ func Login(db *gorm.DB) gin.HandlerFunc {
 			return
 		}
 
+		// Refuse login for non-normal accounts (disabled / locked / unactivated).
+		if user.Status != models.StatusNormal {
+			c.Redirect(http.StatusFound, "/login?error=1")
+			return
+		}
+
 		// Create session.
 		session := sessions.Default(c)
 		session.Set("user_id", user.ID)