feat(ops): add tenant admin user management module

Adds /admin-users CRUD on the ops backend, covering listing, plan/role/KOL
toggles, subscription expiry, status flips and password resets, with a
configurable default plan code. The ops console exposes a new top-level
"用户管理" view and reorganises the sidebar so 操作员管理 and 审计日志
move under a "系统设置" group; AccountsView is renamed accordingly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/cmd/ops-api/main.go

@@ -12,8 +12,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	opsconfig "github.com/geo-platform/tenant-api/internal/ops/config"
 	"github.com/geo-platform/tenant-api/internal/ops/app"
+	opsconfig "github.com/geo-platform/tenant-api/internal/ops/config"
 	"github.com/geo-platform/tenant-api/internal/ops/repository"
 	"github.com/geo-platform/tenant-api/internal/ops/transport"
 	"github.com/geo-platform/tenant-api/internal/shared/observability"
@@ -45,12 +45,14 @@ func main() {
 	defer pool.Close()
 
 	accountsRepo := repository.NewAccountRepository(pool)
+	adminUsersRepo := repository.NewAdminUserRepository(pool)
 	auditsRepo := repository.NewAuditRepository(pool)
 
 	auditSvc := app.NewAuditService(auditsRepo, logger)
 	issuer := app.NewTokenIssuer(cfg.JWT.Secret, cfg.JWT.AccessTTL)
 	authSvc := app.NewAuthService(accountsRepo, auditSvc, issuer)
 	accountSvc := app.NewAccountService(accountsRepo, auditSvc)
+	adminUserSvc := app.NewAdminUserService(adminUsersRepo, auditSvc, cfg.AdminUsers.DefaultPlanCode)
 
 	if err := app.SeedDefaultAdmin(ctx, accountsRepo, app.DefaultAdminSeed{
 		Username:    cfg.DefaultAdmin.Username,
@@ -67,13 +69,14 @@ func main() {
 	engine := gin.New()
 
 	transport.RegisterRoutes(transport.Deps{
-		Engine:   engine,
-		Logger:   logger,
-		DB:       pool,
-		Issuer:   issuer,
-		Auth:     authSvc,
-		Accounts: accountSvc,
-		Audits:   auditSvc,
+		Engine:     engine,
+		Logger:     logger,
+		DB:         pool,
+		Issuer:     issuer,
+		Auth:       authSvc,
+		Accounts:   accountSvc,
+		AdminUsers: adminUserSvc,
+		Audits:     auditSvc,
 	})
 
 	addr := fmt.Sprintf(":%d", cfg.Server.Port)