feat: multi-user UI login with admin and monitor roles

Add sac_users table, JWT roles, settings/users API guarded for admin, Users page in UI, and sac_manage_user.py CLI.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/router.ts

@@ -1,5 +1,5 @@
 import { createRouter, createWebHistory } from "vue-router";
-import { getToken } from "./api";
+import { getToken, isAdmin, setRole, fetchMe } from "./api";
 import EventsView from "./views/EventsView.vue";
 import EventDetailView from "./views/EventDetailView.vue";
 import HostsView from "./views/HostsView.vue";
@@ -9,6 +9,7 @@ import ProblemDetailView from "./views/ProblemDetailView.vue";
 import DashboardView from "./views/DashboardView.vue";
 import ReportsView from "./views/ReportsView.vue";
 import SettingsView from "./views/SettingsView.vue";
+import UsersView from "./views/UsersView.vue";
 
 const router = createRouter({
   history: createWebHistory(),
@@ -22,14 +23,28 @@ const router = createRouter({
     { path: "/hosts", component: HostsView },
     { path: "/problems", component: ProblemsView },
     { path: "/problems/:id", component: ProblemDetailView, props: true },
-    { path: "/settings", component: SettingsView },
+    { path: "/settings", component: SettingsView, meta: { adminOnly: true } },
+    { path: "/users", component: UsersView, meta: { adminOnly: true } },
   ],
 });
 
-router.beforeEach((to) => {
+router.beforeEach(async (to) => {
   if (to.path === "/login") return true;
   if (!getToken()) return { path: "/login" };
+  if (to.meta.adminOnly && !isAdmin()) {
+    return { path: "/dashboard" };
+  }
   return true;
 });
 
 export default router;
+
+export async function refreshSessionRole(): Promise<void> {
+  if (!getToken()) return;
+  try {
+    const me = await fetchMe();
+    setRole(me.role);
+  } catch {
+    /* 401 handled in apiFetch */
+  }
+}