feat(admin): let admins change user roles

V32 adds role_changed_at and the role_change log. Role changes lock
the admin rows, so there is always one admin left; the last admin
cannot delete their own account. Login and refresh read the role
under the user lock. Tokens issued before a role change are refused.

src/test/resources/contract/auth-core-contract.json

@@ -37,12 +37,12 @@
     "applyStates": {
       "method": "POST",
       "path": "/internal/accounts/states",
-      "request": {"accounts": [{"userId": 42, "steamId": 76561198000000001, "displayName": "lobo", "blocked": true}]}
+      "request": {"accounts": [{"userId": 42, "steamId": 76561198000000001, "displayName": "lobo", "blocked": true, "roleChangedAt": "2026-10-04T12:00:00Z"}]}
     },
     "replaceStates": {
       "method": "PUT",
       "path": "/internal/accounts/states",
-      "request": {"accounts": [{"userId": 42, "steamId": null, "displayName": "lobo", "blocked": false}]}
+      "request": {"accounts": [{"userId": 42, "steamId": null, "displayName": "lobo", "blocked": false, "roleChangedAt": null}]}
     },
     "purge": {
       "method": "POST",