feat: Phase 1 - user/password API extensions and auth route fix

frontend/src/api/client.ts

@@ -12,6 +12,11 @@ import type {
   CreateHealthCheckRequest,
   UpdateHealthCheckRequest,
   HealthCheckListResponse,
+  User,
+  ChangePasswordRequest,
+  AdminResetPasswordRequest,
+  UpdateUserRequest,
+  CreateUserRequest,
 } from '../types'
 
 const BASE_URL = '/api/v1'
@@ -291,3 +296,18 @@ export const healthChecksApi = {
   test: (hostId: string, checkId: string) =>
     apiClient.post<HealthCheckWithResult>(`/hosts/${hostId}/health-checks/${checkId}/test`),
 }
+
+// ── Users API ──────────────────────────────────────────────────────────────
+export const usersApi = {
+  list: () => apiClient.get<User[]>('/users'),
+  get: (id: string) => apiClient.get<User>(`/users/${id}`),
+  getMe: () => apiClient.get<User>('/users/me'),
+  create: (data: CreateUserRequest) => apiClient.post('/users', data),
+  update: (id: string, data: UpdateUserRequest) => apiClient.put(`/users/${id}`, data),
+  delete: (id: string) => apiClient.delete(`/users/${id}`),
+  revokeSessions: (id: string) => apiClient.post(`/users/${id}/revoke`),
+  changePassword: (data: ChangePasswordRequest) => apiClient.put('/users/me/password', data),
+  adminResetPassword: (id: string, data: AdminResetPasswordRequest) => apiClient.put(`/users/${id}/password`, data),
+  adminDisableMfa: (id: string) => apiClient.delete(`/users/${id}/mfa`),
+  disableMfa: (password: string) => apiClient.delete('/auth/mfa', { data: { password } }),
+}

frontend/src/types/index.ts

@@ -53,9 +53,36 @@ export interface User {
   auth_provider: AuthProvider
   mfa_enabled: boolean
   is_active: boolean
+  force_password_reset: boolean
   last_login_at?: string
 }
 
+export interface ChangePasswordRequest {
+  current_password: string
+  new_password: string
+}
+
+export interface AdminResetPasswordRequest {
+  new_password: string
+  force_password_reset?: boolean
+}
+
+export interface UpdateUserRequest {
+  display_name?: string
+  email?: string
+  role?: string
+  is_active?: boolean
+  force_password_reset?: boolean
+}
+
+export interface CreateUserRequest {
+  username: string
+  display_name?: string
+  email: string
+  role: string
+  password: string
+}
+
 export interface FleetStatus {
   total_hosts: number
   healthy: number