Admin Usersi

Provision admins, assign/revoke roles, suspend/reinstate, offboard, and emergency-disable — every state-changing action under dual-control and written to the audit log (PH4-003).