feat(auth): admin UI for user management + change-password frontend

Backend additions:
- User.lastLoginAt column (updated on each successful login)
- AdminUserSummary DTO (id, username, createdAt, lastLoginAt, isAdmin, mustChangePassword)
- GET /api/auth/admin/users (RolesAllowed("admin")) -> array of summaries
- AuthService.listUsersForAdmin() + AuthService.authenticate() now @Transactional and bumps lastLoginAt

Frontend (Phase 1):
- User type extended with mustChangePassword + isAdmin
- api.changePassword() / api.adminResetPassword() / api.adminListUsers()
- AuthContext exposes changePassword
- ChangePasswordPage.tsx (full-page, current + new + confirm, errors inline)
- App.tsx routes LoginPage -> ChangePasswordPage -> AuthenticatedApp

Frontend (Phase 2):
- TabBar supports optional 'usuarios' tab (shown only if user.isAdmin)
- UsersAdminPage.tsx: lista todos los usuarios con badges de rol y estado,
  botón "Resetear contraseña" con modal inline que llama adminResetPassword
- Header de AuthenticatedApp muestra un badge 'admin' al lado del username

Both mvn compile and npm tsc + vite build pass clean.

src/main/java/com/l2/shots/auth/AuthResource.java

@@ -144,6 +144,13 @@ public class AuthResource {
                 .orElse(Response.status(401).build());
     }
 
+    @GET
+    @Path("/admin/users")
+    @RolesAllowed("admin")
+    public Response adminListUsers() {
+        return Response.ok(authService.listUsersForAdmin()).build();
+    }
+
     @GET
     @Path("/check")
     @Authenticated