POST /users/{id}/promote and /demote set a user's role (admin/user), admin-only (403 otherwise). Mirrors the verify endpoints: SetRole use case + repo method, validated role. Unit, admin-flow, and integration tests included.