feat(users): admin promote/demote endpoints

POST /users/{id}/promote and /demote set a user's role (admin/user), admin-only
(403 otherwise). Mirrors the verify endpoints: SetRole use case + repo method,
validated role. Unit, admin-flow, and integration tests included.

users/internal/usecase/errors.go

@@ -15,4 +15,5 @@ var (
 	ErrInvalidCredentials = errors.New("invalid email or password")
 	ErrPasswordTooShort   = errors.New("password too short")
 	ErrPasswordTooLong    = errors.New("password too long")
+	ErrInvalidRole        = errors.New("invalid role")
 )