- Server /auth/user now returns role for client navigation affordance
- Web auth types map role through get-user, login, register
- Add admin web API modules: list, detail, update, reset password, delete, restore
- Add admin query keys with mutation invalidation metadata
- Server admin authorization remains source of truth

- Add AdminLayout with dashboard-like chrome, shield mark, back-to-app link
- Separate admin route group (_protected/admin) with role guard in beforeLoad
- Add accounts page with status filters and user table (desktop) / cards (mobile)
- Add user edit dialog: name, role, password reset, delete, restore
- Role selector uses DropdownMenu pattern matching settings page
- Disable admin-target mutations (last-admin safety, server guard authoritative)
- Add admin entry to UserMenu for admin role only
- Add table outer border and full i18n namespace for admin copy

…e counts

Phase 4b - service connections:
- Add GET /admin/health/connections admin route
- Add browser.service checkHealth() probe with 5s timeout
- Add admin-health.service aggregating connection checks (camoufox first)
- Break import cycle via lazy import of browser.service
- Add admin connections panel with 30s auto-refresh
- Calm status colors: success/warning/danger, no urgency framing
- Add connections route and nav item

Phase 4c - per-user article counts:
- Add countArticlesByUser() repository method (groupBy aggregation)
- Enrich admin user list response with articleCount
- Add articles column to admin user table (desktop) and mobile card
- Use tabular-nums for stable numeric layout

Verification:
- pnpm --filter @loreo/server typecheck passed
- pnpm --filter @loreo/web typecheck passed
- pnpm --filter @loreo/server exec vitest --run admin files passed: 24 tests

Login/register routes used selectUsersSchema which omits role. The web client
cached the user via setQueryData with role undefined, and staleTime: Infinity
on useGetUser prevented refetch. This hid the Admin menu entry on the main
page for admin users. Switch login/register response schemas to
currentUserSchema and include role in both handlers.

Locks the contract added in the previous role-exposure fix. Future
regressions that strip role from login/register responses will now fail
the suite instead of silently breaking admin navigation on the web.