feat(users): add admin-granted verified badge for trusted contributors

- migration 0002: users.verified boolean, default false
- verified rides in the JWT (role + verified claims)
- POST /users/{id}/verify + /unverify, admin-only (403 otherwise)
- Issue now takes the whole user so trust claims travel in the token
- unit + integration + admin-flow tests

users/internal/domain/user.go

@@ -29,8 +29,12 @@ type User struct {
 	Email        string
 	PasswordHash string
 	Role         Role
-	CreatedAt    time.Time
-	UpdatedAt    time.Time
+	// Verified marks a trusted contributor whose workers' results the
+	// coordinator accepts without quorum. Distinct from Role; granted by an
+	// admin, defaults to false.
+	Verified  bool
+	CreatedAt time.Time
+	UpdatedAt time.Time
 }
 
 // NewUser builds a freshly registered account. It normalises the email and