feat: multi-user UI login with admin and monitor roles

Add sac_users table, JWT roles, settings/users API guarded for admin, Users page in UI, and sac_manage_user.py CLI.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/conftest.py

@@ -18,7 +18,9 @@ from app.auth.jwt_auth import create_access_token
 from app.database import Base, get_db
 from app.main import app as fastapi_app
 import app.models  # noqa: F401 — register all tables on Base.metadata
-from app.models import ApiKey
+from app.models import ApiKey, User
+from app.models.user import USER_ROLE_ADMIN, USER_ROLE_MONITOR
+from app.services.user_auth import hash_password
 
 TEST_API_KEY = os.environ["SAC_BOOTSTRAP_API_KEY"]
 
@@ -57,6 +59,22 @@ def db_session(db_engine):
             is_active=True,
         )
     )
+    session.add(
+        User(
+            username="test-admin",
+            password_hash=hash_password("test-admin-password"),
+            role=USER_ROLE_ADMIN,
+            is_active=True,
+        )
+    )
+    session.add(
+        User(
+            username="test-monitor",
+            password_hash=hash_password("test-monitor-password"),
+            role=USER_ROLE_MONITOR,
+            is_active=True,
+        )
+    )
     session.commit()
     yield session
     session.close()
@@ -65,6 +83,7 @@ def db_session(db_engine):
 @pytest.fixture
 def client(db_session, monkeypatch):
     monkeypatch.setattr("app.main.bootstrap_api_key", lambda: None)
+    monkeypatch.setattr("app.main.bootstrap_users", lambda: None)
 
     def override_get_db():
         try:
@@ -85,5 +104,11 @@ def auth_headers():
 
 @pytest.fixture
 def jwt_headers():
-    token = create_access_token("test-admin")
+    token = create_access_token("test-admin", USER_ROLE_ADMIN)
+    return {"Authorization": f"Bearer {token}"}
+
+
+@pytest.fixture
+def jwt_monitor_headers():
+    token = create_access_token("test-monitor", USER_ROLE_MONITOR)
     return {"Authorization": f"Bearer {token}"}