feat(admin): scoped user-management with approval queue (#64, #85)

[martinydeAI]

Links to issues

Closes #64.
Closes #85.

Implements PR 5 of the User management milestone plan.

! This pr should not be handled before other User management PRs have been merged to keep a proper comparison.

do-not-merge — depends on PR #87 (#84) AND PR #86 (#45 + #83).

This branch is feature/issue-84-roles-and-voter (PR #87) with
feature/issue-45-user-entity-extension (PR #86) merged in. The
branch needs PR #87's voter + EmailDomain helper AND PR #86's
User.status field. Once both PRs land:

1. Rebase this branch onto fresh develop (drop the merge commit,
   keep the feature commit on top).
2. Remove the do-not-merge label.
3. Drop the block reason from the body.

Description

Admin user-management surface:

• GET /admin/users — list view scoped by role. Admins see every
  user, domain managers see only same-domain users (via the
  EmailDomain helper). Optional ?status=pending|approved|blocked
  filter powers the approval queue (feat: approval queue for domain managers #64).
• GET /admin/users/pending — sugar route, 302 to
  /admin/users?status=pending so feat: approval queue for domain managers #64's URL keeps working.
• POST /admin/users/{id}/approve and .../block — flip the user's
  status. Gated by IsGranted('APPROVE_USER' / 'BLOCK_USER', subject: $user) so PR feat(security): ROLE_DOMAIN_MANAGER, role hierarchy, domain-scoped voter (#84) #87's voter fires on every transition. CSRF-protected
  with the admin-user-action intent token.
• App\Security\UserApproval — single home for the
  Pending -> Approved / Approved -> Blocked transitions.
• App\Repository\UserRepository::findVisibleTo() — scoped finder
  with optional status filter. Domain managers without an email
  defensively get an empty result (defence in depth — the firewall
  • voter would already block, but the repository falls through
    rather than running a query against an unresolved domain).
• ^/admin access_control rule + per-action IsGranted —
  belt-and-braces.
• Template re-uses Form/Button, Form/Label, Form/TextInput,
  Eyebrow, and base layout — no new component families.
• back parameter on the action forms only honours /admin/users…
  URLs (hostile-redirect guard).

Screenshot of the result

n/a — UI matches the existing layout primitives. Manual screenshot
can be added on request.

Checklist

• My code is covered by test cases.
• My code passes our test (all our tests).
• My code passes our static analysis suite.
• My code passes our continuous integration process.

Verified locally:

• task coding-standards-check — all green.
• task test-coverage — 85 tests, 252 assertions, 100 %
  coverage.

Additional comments or questions

The "domain manager promotion" UI is not in scope. Granting a
user ROLE_DOMAIN_MANAGER (or revoking it) is still done via the
console for now — separate UX decision, not tracked as its own issue
yet.

The voter's IsGranted runs before the controller body, so a
cross-domain POST yields 403 from the voter — never reaching the
CSRF check. Both paths are exercised by the test suite.

#12 (broader RBAC meta) can be closed when this PR lands per the
plan — its concrete payload is now the role set in #84 + the scoped
admin access here.

---

Details - AI specificities

• ADR: docs/adr/006-user-approval-and-account-state.md
  (Draft; lands via docs: add ADR 004 — user registration, approval, and account state #61). Specifically the "Approval queue" and
  "Domain manager — a role, not a flag" sections.
• Stacked on PR feat(security): ROLE_DOMAIN_MANAGER, role hierarchy, domain-scoped voter (#84) #87 (base) + merged PR feat(user): add name and status fields per ADR 006 (#45, #83) #86. Once both PRs land:
  1. Rebase this branch onto fresh develop.
  2. Remove the do-not-merge label.
  3. Drop the block reason from the body.
  4. Open a separate close-out comment on User roles and permissions #12 pointing at this PR
     and feat(security): ROLE_DOMAIN_MANAGER, role hierarchy, domain-scoped voter (#84) #87.
• Test changes pre-approved: UserRepositoryTest gets the three
  new methods (testFindVisibleToReturnsEveryUserForAdmin,
  testFindVisibleToScopesByDomainForDomainManager,
  testFindVisibleToFiltersByStatus) the user approved earlier. The
  scoping test absorbs the "non-manager empty" and
  "domain-manager-without-email empty" branches as sub-assertions
  rather than adding a 4th method, to stay within the approved
  boundary.
• Out of scope:
  • Bulk actions, search / sort / pagination — defer until the list
    grows.
  • Email notifications on approval / block — not currently tracked.
  • UI to assign / revoke ROLE_DOMAIN_MANAGER — separate concern.
• CSRF intent: admin-user-action. Same token works for both
  approve + block actions; the route + voter combination is what
  distinguishes the actual operation.