feat(admin): users-management page with admin/agent role toggles

[mpge]

Summary

• Adds an admin users-management endpoint (GET /escalated/api/admin/users, PATCH /escalated/api/admin/users/{userId}/role) backing the Escalated/Admin/Users/Index page shipped with the shared @escalated-dev/escalated frontend package — admins can grant or revoke is_admin / is_agent from the panel instead of editing the database directly.
• UserService.updateRole enforces the cross-role rules: promoting to admin also flips agent on; demoting an admin via the agent toggle revokes both flags in one step.
• Self-demote on admin is rejected server-side (HTTP 422), so an admin cannot lock themselves out of the panel they are using.
• Pairs with the Laravel reference port at feat(admin): users-management page with admin/agent role toggles escalated-laravel#94.

Notes for reviewers

• The default install pins this to is_admin / is_agent columns on the existing escalated_agent_profiles table (added via V3__add_user_role_flags.sql). Hosts wiring authorisation differently (Spring Security GrantedAuthority, a custom user table, etc.) can override AdminUserController in their own configuration — there is a comment to that effect in UserService.
• Demoting an admin via the agent toggle revokes both flags in one step (otherwise the admin gate would stay on while the agent gate was off, which is confusing).
• The Spring port uses AgentProfile as the natural mapping for "host user with helpdesk access," since (unlike the Laravel port) there is no separate host user table in this repo.

Test plan

• AdminUserControllerTest — 7 new MockMvc cases (list, search filter, admin promotion flips agent on, agent-only promotion leaves admin false, self-demote rejected with no save, agent revoke from admin demotes fully, unknown role rejected)
• CI: ./gradlew test green
• Manual: an admin loads the users page, search filters by name + email, toggling Admin grants both flags, toggling self-demote returns 422

[mpge]

Blocked on a pre-existing main-branch CI failure: compileJava cannot resolve dev.escalated:escalated-locale:0.1.0 from Maven Central (the artifact has not been published yet — see escalated-dev/escalated-locale .github/workflows/publish.yml, which only fires on v* tags and requires MAVEN_* secrets).

Both checkstyle and test jobs on main started failing at commit 41aa928 (#58), independent of this PR. The PR itself is complete:

• 7 new MockMvc cases in AdminUserControllerTest
• UserService.updateRole with self-demote guard
• V3__add_user_role_flags.sql adds is_admin / is_agent to escalated_agent_profiles
• CHANGELOG.md updated under [Unreleased]

Holding off on merge until the locale artifact is published / main is unblocked. Not merging a red CI run.