feat: add admin user management with role-based access and self-protection

- Add AdminRequired middleware for admin-role routes
- Add login status check to reject disabled/locked accounts
- Add CRUD handlers (list, create, edit, delete) for users
- Add user_list and user_form templates with role/status badges
- Add nav entry and dashboard button for user management
- Add dynamic user count on admin dashboard
- Fix userIDFromSession to handle all numeric session types
- Self-protection: cannot delete/disable self or demote last admin
- Add EN/ZH i18n keys for all user management strings

templates/layouts/base.html

@@ -53,6 +53,9 @@
                             <a href="/admin/comments" class="block px-4 py-2 text-sm text-gray-700 hover:bg-gray-100 transition-colors">
                                 {{index .Tr "admin_comments"}}
                             </a>
+                            <a href="/admin/users" class="block px-4 py-2 text-sm text-gray-700 hover:bg-gray-100 transition-colors">
+                                {{index .Tr "admin_users"}}
+                            </a>
                             {{end}}
                             <div class="border-t border-gray-100 my-1"></div>
                             <form action="/logout" method="post" class="m-0">