E2E: user detail, sessions, and device-replacement recovery

[Bccorb]

Part of #176. Depends on #177.

Goal

Cover the user detail page: profile information, per-user sessions and revocation, anomaly signals, and admin-assisted device-replacement recovery.

Scope

• Detail loads and renders the seeded user's profile, roles, and verification state.
• Per-user sessions list renders; revoking a single session requires step-up and updates the list.
• Revoke-all-sessions requires confirm plus step-up and clears the sessions.
• User anomaly and timeseries panels render for seeded data, and empty when there is none.
• Device-replacement recovery: write admin runs it behind step-up, sees only the resulting counts, and no credential secrets are shown.
• Read-only admin sees the detail view but not the revoke or recovery controls.
• Loading, empty, and error states render correctly, including a not-found user id.

Key files

src/pages/UserDetail.tsx, src/hooks/useUserDetail.ts, src/hooks/useSessions.ts, src/hooks/useRevokeSession.ts, src/hooks/useRevokeAllUserSessions.ts, src/hooks/useUserAnomalies.ts, src/hooks/useUserTimeseries.ts, src/hooks/useDeviceReplacementRecovery.ts.