feat(users): admin promote/demote endpoints

POST /users/{id}/promote and /demote set a user's role (admin/user), admin-only
(403 otherwise). Mirrors the verify endpoints: SetRole use case + repo method,
validated role. Unit, admin-flow, and integration tests included.

users/cmd/userservice/main.go

@@ -57,6 +57,7 @@ func run() error {
 		Register:    usecase.NewRegister(users, hasher, clock),
 		Login:       usecase.NewLogin(users, hasher, issuer),
 		SetVerified: usecase.NewSetVerified(users),
+		SetRole:     usecase.NewSetRole(users),
 		Users:       users,
 	}