feat: add admin user management with role-based access and self-protection

- Add AdminRequired middleware for admin-role routes
- Add login status check to reject disabled/locked accounts
- Add CRUD handlers (list, create, edit, delete) for users
- Add user_list and user_form templates with role/status badges
- Add nav entry and dashboard button for user management
- Add dynamic user count on admin dashboard
- Fix userIDFromSession to handle all numeric session types
- Self-protection: cannot delete/disable self or demote last admin
- Add EN/ZH i18n keys for all user management strings

middleware/auth.go

@@ -26,6 +26,28 @@ func AuthRequired() gin.HandlerFunc {
 	}
 }
 
+// AdminRequired is middleware that restricts a route to admin-role users. It
+// must run after AuthRequired (which guarantees a session user exists). Non-admin
+// users are redirected back to the admin dashboard.
+func AdminRequired(db *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		session := sessions.Default(c)
+		userID := session.Get("user_id")
+		if userID == nil {
+			c.Redirect(http.StatusFound, "/login")
+			c.Abort()
+			return
+		}
+		var user models.User
+		if err := db.First(&user, userID).Error; err != nil || user.Role != models.RoleAdmin {
+			c.Redirect(http.StatusFound, "/admin")
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}
+
 // SetUserContext is global middleware that reads the session and sets
 // template-friendly context values for all pages (language, auth state, etc.).
 func SetUserContext(db *gorm.DB) gin.HandlerFunc {