feat(users): manage staff profiles and role permissions

[temps-code]

Objective

Implement staff profile management, role-based permissions, and full profile
lifecycle including deactivation via soft delete, administrative purge, and
filtered list navigation with search.

MVP Metadata

• MVP Phase: Core Platform
• Module: users
• Priority: High
• Type: Feature
• FR: FR-02, FR-16
• Branch Target: features

Problem

The schema and session model include profiles and roles, but the app does not yet
let administrators manage staff profiles or enforce role-based access in UI
actions/routes.

Additionally, staff members may leave or be reassigned, requiring a deactivation
mechanism that revokes system access while preserving their historical records
(task assignments, housekeeping logs, maintenance tickets). Soft delete covers
deactivation; hard delete (purge) is available only when no historical records
reference the profile.

Acceptance Criteria

• Staff profiles can be listed by active property.
• Staff profiles can be created or edited with role and active/inactive status, within MVP backend constraints.
• Roles use the documented set: administrator, manager, receptionist, housekeeping, maintenance.
• User/profile records remain scoped by property.
• Protected routes/actions define minimum role expectations.
• Non-admin users do not see administrative settings/actions that are not relevant to them.

Soft Delete & Lifecycle

• Staff profiles can be soft-deleted (set deleted_at). Active list only shows records where deleted_at IS NULL.
• Only administrator role can soft-delete staff profiles.
• Soft delete is blocked at service layer if the user has open task assignments (housekeeping or maintenance), returning a descriptive error.
• Deactivated users lose system access but their historical records (task assignments, audit logs) remain linked and intact.
• A confirmation modal is shown before soft delete.

Hard Delete (Purge — Administrator Only)

• Administrators can permanently purge a soft-deleted staff profile from the recycle bin.
• Purge is blocked at service layer if any historical record (tasks, assignments) references the user, returning the count of blocking records.
• A strict irreversible-action warning dialog is shown before purging.

Filtering & Search

• User list can be filtered by role (administrator, manager, receptionist, housekeeping, maintenance).
• User list can be filtered by active/inactive status.
• User list supports text search by name or email.
• Empty/loading/error states are handled safely for all filter combinations.

Evidence Expected

• Link related commits and PRs.
• Include screenshots for UI changes when applicable.
• Include test/build evidence when implementation touches app/runtime code.