AUTH-7 User server actions

[wlenig]

Created lib/users.ts with:

• createUser(supabaseUserId) — create a user record linked to a Supabase auth user
• getUser(id, includeEmail?) — get a user by SGA user ID, optionally include Supabase auth email
• getUsers(filters?) — list all users, optional isAdmin filter
• updateUser(id, data) — update user fields (e.g. toggle isAdmin)
• deleteUser(id) — delete from users table and from auth.users via service role