E2E: Users directory and create/edit/delete lifecycle

[Bccorb]

Part of #176. Depends on #177.

Goal

Cover the Users directory and its full create, edit, and delete lifecycle, including the step-up authentication the API requires before write actions.

Scope

• List renders seeded users with roles, verification state, and activity columns.
• Search filters the directory and debounces input.
• Create user: modal opens, validates input, requires fresh step-up, submits, shows the success toast, and the new user appears.
• Edit user: modal pre-fills, saves changes (including clearing phone to null), requires step-up, and reflects the update.
• Delete user: confirm dialog plus step-up, sends the delete, and removes the row.
• Step-up failure aborts the action and surfaces the failure toast without mutating data.
• Row or name navigates to the user detail page.
• Read-only admin sees no create, edit, or delete controls.
• Empty, loading, and error states render correctly.

Key files

src/pages/Users.tsx, src/components/CreateUserModal.tsx, src/components/EditUserModal.tsx, src/hooks/useUsers.ts, src/hooks/useCreateUser.ts, src/hooks/useUpdateUser.ts, src/hooks/useDeleteUser.ts, src/hooks/useStepUpGuard.ts, src/components/ConfirmProvider.tsx.