feat(admin): add the admin users page and view as

README.md

@@ -54,6 +54,9 @@ To Be Played is split into three repositories:
   to Core once per page load (`POST /api/library/broken-images`, only with a session). Core repairs it at night;
   a repaired cover comes back as `imageUrl`.
 - German and English, dark mode, mobile layout, session-expired message instead of a silent logout.
+- **Admin** (PLATFORM_ADMIN only, `/admin/users`): search the users, block, unblock and delete them (the email is
+  typed to confirm a delete). "View as" in the menu switches the own session to User or Auditor and back; a badge
+  shows the lower role. Auth checks every right on the server.
 - **Delete my account** in the settings: a dialog asks for the own email and the password. Auth blocks the
   account at once and removes it after 30 days; the page ends the session and goes to the landing page.
 - **Build version** in the settings: commit and build time of Frontend, Auth and Core, each hash links to its