feat: add admin user management with role-based access and self-protection

- Add AdminRequired middleware for admin-role routes
- Add login status check to reject disabled/locked accounts
- Add CRUD handlers (list, create, edit, delete) for users
- Add user_list and user_form templates with role/status badges
- Add nav entry and dashboard button for user management
- Add dynamic user count on admin dashboard
- Fix userIDFromSession to handle all numeric session types
- Self-protection: cannot delete/disable self or demote last admin
- Add EN/ZH i18n keys for all user management strings

main.go

@@ -74,6 +74,18 @@ func main() {
 		admin.POST("/comments/:id/delete", handlers.CommentDelete(db))
 	}
 
+	// Protected admin user-management routes (admin role only).
+	users := router.Group("/admin/users")
+	users.Use(middleware.AuthRequired(), middleware.AdminRequired(db))
+	{
+		users.GET("", handlers.UserListPage(db))
+		users.GET("/new", handlers.UserCreatePage(db))
+		users.POST("/new", handlers.UserCreate(db))
+		users.GET("/:id/edit", handlers.UserEditPage(db))
+		users.POST("/:id/edit", handlers.UserUpdate(db))
+		users.POST("/:id/delete", handlers.UserDelete(db))
+	}
+
 	// Protected article attachment routes (AJAX uploads / management).
 	attachments := router.Group("/admin/articles")
 	attachments.Use(middleware.AuthRequired())