feat(users): admin promote/demote endpoints

POST /users/{id}/promote and /demote set a user's role (admin/user), admin-only
(403 otherwise). Mirrors the verify endpoints: SetRole use case + repo method,
validated role. Unit, admin-flow, and integration tests included.

users/internal/usecase/errorpaths_test.go

@@ -32,6 +32,9 @@ func (s stubRepo) GetByID(context.Context, uuid.UUID) (*domain.User, error) {
 func (s stubRepo) SetVerified(context.Context, uuid.UUID, bool) error {
 	return usecase.ErrUserNotFound
 }
+func (s stubRepo) SetRole(context.Context, uuid.UUID, domain.Role) error {
+	return usecase.ErrUserNotFound
+}
 
 type stubHasher struct {
 	hashErr    error