Add roles and users admin UI with role management API

Backend:
- GET /v1/users (list company users)
- GET/POST/PATCH/DELETE /v1/roles (role CRUD with permissions)
- GET/POST/DELETE /v1/users/:userId/roles (role assignment)
- GET /v1/me/permissions (current user's effective permissions)

Frontend:
- Roles list page with kebab menu (edit permissions, delete custom)
- Role detail page with grouped permission checkboxes and inheritance note
- New role page with auto-generated slug
- Users list page showing assigned roles per user
- Manage Roles dialog for adding/removing roles per user
- Sidebar: Admin section with Users, Roles, Help links

packages/admin/src/api/users.ts

@@ -0,0 +1,22 @@
+import { queryOptions } from '@tanstack/react-query'
+import { api } from '@/lib/api-client'
+
+export interface UserRecord {
+  id: string
+  email: string
+  firstName: string
+  lastName: string
+  role: string
+  createdAt: string
+}
+
+export const userKeys = {
+  roles: (userId: string) => ['users', userId, 'roles'] as const,
+}
+
+export function userRolesOptions(userId: string) {
+  return queryOptions({
+    queryKey: userKeys.roles(userId),
+    queryFn: () => api.get<{ data: { id: string; name: string; slug: string; isSystem: boolean }[] }>(`/v1/users/${userId}/roles`),
+  })
+}