Add paginated users/roles, user status, frontend permissions, profile pictures, identifier file storage

- Users page: paginated, searchable, sortable with inline roles (no N+1)
- Roles page: paginated, searchable, sortable + /roles/all for dropdowns
- User is_active field with migration, PATCH toggle, auth check (disabled=401)
- Frontend permission checks: auth store loads permissions, sidebar/buttons conditional
- Profile pictures via file storage for users and members, avatar component
- Identifier images use file storage API instead of base64
- Fix TypeScript errors across admin UI
- 64 API tests passing (10 new)

packages/backend/api-tests/suites/files.ts

@@ -139,6 +139,35 @@ suite('Files', { tags: ['files', 'storage'] }, (t) => {
     t.assert.equal(res.status, 400)
   })
 
+  t.test('uploads profile picture for user entity type', { tags: ['upload', 'profile'] }, async () => {
+    // Get the current test user ID from the users list
+    const usersRes = await t.api.get('/v1/users')
+    const testUser = usersRes.data.data[0]
+    t.assert.ok(testUser)
+
+    const formData = new FormData()
+    formData.append('file', new Blob([TINY_JPEG], { type: 'image/jpeg' }), 'avatar.jpg')
+    formData.append('entityType', 'user')
+    formData.append('entityId', testUser.id)
+    formData.append('category', 'profile')
+
+    const res = await fetch(`${t.baseUrl}/v1/files`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${t.token}` },
+      body: formData,
+    })
+    const data = await res.json()
+
+    t.assert.equal(res.status, 201)
+    t.assert.equal(data.entityType, 'user')
+    t.assert.equal(data.category, 'profile')
+
+    // Verify it shows up in files list
+    const listRes = await t.api.get('/v1/files', { entityType: 'user', entityId: testUser.id })
+    t.assert.status(listRes, 200)
+    t.assert.greaterThan(listRes.data.data.length, 0)
+  })
+
   t.test('returns 404 for missing file', { tags: ['read'] }, async () => {
     const res = await t.api.get('/v1/files/a0000000-0000-0000-0000-999999999999')
     t.assert.status(res, 404)