feat(users): admin promote/demote endpoints

POST /users/{id}/promote and /demote set a user's role (admin/user), admin-only
(403 otherwise). Mirrors the verify endpoints: SetRole use case + repo method,
validated role. Unit, admin-flow, and integration tests included.

users/internal/usecase/ports.go

@@ -25,6 +25,9 @@ type UserRepository interface {
 	// SetVerified toggles the verified flag, returning ErrUserNotFound if no
 	// such user exists.
 	SetVerified(ctx context.Context, id uuid.UUID, verified bool) error
+	// SetRole changes a user's role, returning ErrUserNotFound if no such user
+	// exists.
+	SetRole(ctx context.Context, id uuid.UUID, role domain.Role) error
 }
 
 // PasswordHasher hashes and verifies passwords. The bcrypt adapter satisfies it.