feat(users): add admin-granted verified badge for trusted contributors

- migration 0002: users.verified boolean, default false
- verified rides in the JWT (role + verified claims)
- POST /users/{id}/verify + /unverify, admin-only (403 otherwise)
- Issue now takes the whole user so trust claims travel in the token
- unit + integration + admin-flow tests

users/cmd/userservice/main.go

@@ -54,9 +54,10 @@ func run() error {
 	issuer := auth.NewIssuer(cfg.JWTSecret, cfg.TokenTTL, clock.Now)
 
 	uc := apihttp.UseCases{
-		Register: usecase.NewRegister(users, hasher, clock),
-		Login:    usecase.NewLogin(users, hasher, issuer),
-		Users:    users,
+		Register:    usecase.NewRegister(users, hasher, clock),
+		Login:       usecase.NewLogin(users, hasher, issuer),
+		SetVerified: usecase.NewSetVerified(users),
+		Users:       users,
 	}
 
 	handler := apihttp.NewServer(log, uc, issuer)