createUserAction, setUserRoleAction, resetUserPasswordAction, deleteUserAction — all gated by requireAdmin(). Self-demote and last-admin guards prevent the operator from accidentally locking themselves out. /settings/users page lists every operator with inline Demote/Promote, Reset password, and Delete buttons. 10 unit tests.