feat: add role-based user management, audit log, and session tracking

Introduces a full user management system with three roles (admin, operator,
viewer), an audit log, and per-session login history.

Backend:
- app/internal/audit.py: write_audit() helper → audit_log Firestore collection
- app/internal/auth.py: get_role() helper; require_admin_token accepts both
  legacy admin:true claim and new role:"admin" claim for backward compat
- app/routers/users.py: CRUD under /admin/users — list, create (returns
  one-time invite link), get (with sessions), patch role/nodes/name,
  disable, enable, delete; operator role requires ≥1 owned node
- app/routers/links.py: POST /auth/session records sign-in events to
  user_sessions Firestore collection
- app/routers/admin.py: GET /admin/audit paginated endpoint
- app/main.py: register users router

Frontend:
- AuthProvider: exposes role, isAdmin, isOperator, ownedNodeIds from claims
- Nav: role-gated links — viewers get dashboard/calls/incidents/map/alerts/
  trips; operators add nodes/systems/tokens; admins add admin
- admin/page.tsx: new Users tab (list table, create modal, inline edit panel
  with role/nodes editor, disable/enable/delete, login history) and Audit
  Log tab (paginated, color-coded actions)
- login/page.tsx: calls recordSession() on email and Google sign-in
- nodes, systems, tokens pages: role guards redirect viewers to dashboard
- profile/page.tsx: shows accurate role badge and label
- lib/types.ts: UserRole, UserRecord, UserSession, AuditEntry types
- lib/c2api.ts: user management methods + recordSession

Firestore collections added: user_profiles, audit_log, user_sessions
Firebase custom claims schema: { role, owned_node_ids, admin (legacy) }

drb-frontend/lib/c2api.ts

@@ -186,4 +186,34 @@ export const c2api = {
       method: "PUT",
       body: JSON.stringify(flags),
     }),
+
+  // User management (admin only)
+  listUsers: () =>
+    request<import("@/lib/types").UserRecord[]>("/admin/users"),
+  createUser: (body: { email: string; role: string; display_name?: string; owned_node_ids?: string[] }) =>
+    request<import("@/lib/types").UserRecord & { invite_link?: string | null }>("/admin/users", {
+      method: "POST",
+      body: JSON.stringify(body),
+    }),
+  getUser: (uid: string) =>
+    request<import("@/lib/types").UserRecord>(`/admin/users/${uid}`),
+  updateUser: (uid: string, body: { role?: string; owned_node_ids?: string[]; display_name?: string }) =>
+    request<import("@/lib/types").UserRecord>(`/admin/users/${uid}`, {
+      method: "PATCH",
+      body: JSON.stringify(body),
+    }),
+  disableUser: (uid: string) =>
+    request<{ ok: boolean }>(`/admin/users/${uid}/disable`, { method: "POST" }),
+  enableUser: (uid: string) =>
+    request<{ ok: boolean }>(`/admin/users/${uid}/enable`, { method: "POST" }),
+  deleteUser: (uid: string) =>
+    request<{ ok: boolean }>(`/admin/users/${uid}`, { method: "DELETE" }),
+
+  // Audit log (admin only)
+  getAuditLog: (limit = 50, offset = 0) =>
+    request<import("@/lib/types").AuditEntry[]>(`/admin/audit?limit=${limit}&offset=${offset}`),
+
+  // Session recording — called on each explicit sign-in
+  recordSession: () =>
+    request<{ ok: boolean }>("/auth/session", { method: "POST" }),
 };

drb-frontend/lib/types.ts

@@ -1,5 +1,44 @@
 export type NodeStatus = "online" | "offline" | "recording" | "unconfigured";
 export type ApprovalStatus = "pending" | "approved" | "rejected";
+export type UserRole = "admin" | "operator" | "viewer";
+
+export interface UserRecord {
+  uid: string;
+  email: string | null;
+  display_name: string | null;
+  role: UserRole;
+  owned_node_ids: string[];
+  disabled: boolean;
+  creation_time: string | null;
+  last_sign_in: string | null;
+  discord_linked: boolean;
+  discord_username: string | null;
+  discord_user_id: string | null;
+  // only present on GET /admin/users/{uid}
+  sessions?: UserSession[];
+  // only present on POST /admin/users response
+  invite_link?: string | null;
+}
+
+export interface UserSession {
+  session_id: string;
+  uid: string;
+  email: string;
+  timestamp: string;
+  ip: string | null;
+  user_agent: string | null;
+}
+
+export interface AuditEntry {
+  log_id: string;
+  action: string;
+  actor_uid: string;
+  actor_email: string;
+  target_uid: string | null;
+  target_email: string | null;
+  details: Record<string, unknown>;
+  timestamp: string;
+}
 
 export interface NodeRecord {
   node_id: string;