feat(ops): add tenant admin user management module

Adds /admin-users CRUD on the ops backend, covering listing, plan/role/KOL
toggles, subscription expiry, status flips and password resets, with a
configurable default plan code. The ops console exposes a new top-level
"用户管理" view and reorganises the sidebar so 操作员管理 and 审计日志
move under a "系统设置" group; AccountsView is renamed accordingly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/ops/config/config.go

@@ -17,6 +17,7 @@ type Config struct {
 	Log          sharedconfig.LogConfig      `mapstructure:"log"`
 	JWT          JWTConfig                   `mapstructure:"jwt"`
 	DefaultAdmin DefaultAdminConfig          `mapstructure:"default_admin"`
+	AdminUsers   AdminUsersConfig            `mapstructure:"admin_users"`
 }
 
 type JWTConfig struct {
@@ -31,6 +32,10 @@ type DefaultAdminConfig struct {
 	Email       string `mapstructure:"email"`
 }
 
+type AdminUsersConfig struct {
+	DefaultPlanCode string `mapstructure:"default_plan_code"`
+}
+
 func Load(path string) (*Config, error) {
 	v := viper.New()
 	v.SetConfigFile(path)
@@ -46,6 +51,7 @@ func Load(path string) (*Config, error) {
 	v.SetDefault("jwt.access_ttl", 8*time.Hour)
 	v.SetDefault("default_admin.username", "admin")
 	v.SetDefault("default_admin.display_name", "Administrator")
+	v.SetDefault("admin_users.default_plan_code", "free")
 
 	if err := v.ReadInConfig(); err != nil {
 		return nil, fmt.Errorf("read config: %w", err)
@@ -83,5 +89,8 @@ func applyEnvOverrides(cfg *Config) error {
 	if v := os.Getenv("OPS_DEFAULT_ADMIN_EMAIL"); v != "" {
 		cfg.DefaultAdmin.Email = v
 	}
+	if v := os.Getenv("OPS_ADMIN_USERS_DEFAULT_PLAN_CODE"); v != "" {
+		cfg.AdminUsers.DefaultPlanCode = v
+	}
 	return nil
 }