Add staff role with content editing access and admin user management UI

[Copilot]

Admins need to create/manage staff accounts that can log in and edit site content, with the ability to promote staff to admin, demote admins back to staff, and delete staff accounts.

Role & Authorization

• Added Staff role constant and AdminOrStaff = "Admin,Staff" to IdentityHelper
• Staff role registered at startup alongside Admin
• All content controllers now allow AdminOrStaff — staff can edit all content and view analytics: AboutController, AgencyController, CalendarController, AdminController (Analytics), ProgramVideosController, PeopleController
• UserManagementController remains Admin-only

User Management

• New UserManagementController (Admin-only): Index, Create, Promote, Demote, Delete
• Guards against self-demotion and self-deletion
• New UserManagementViewModel carries user ID, email, and role flags

Navigation

• Staff users see the full edit nav menu (same as Admin), including Analytics
• Manage Users link visible to Admin only

Tests

• 16 new tests for UserManagementController covering all actions and edge cases (self-demotion, invalid IDs, failed creation)

Copilot Summary

This PR was generated by GitHub Copilot.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add staff member as authorized user for logging in/editing</issue_title>
<issue_description>The client would like the capability to add another member of their staff to log in to the website and edit information.

Admin users would need to add/remove new users (with a role of staff) and promote them to an admin role and demote them back to staff. Admins can remove staff member accounts</issue_description>

Comments on the Issue (you are @copilot in this section)

@JoeProgrammer88 Manually added another staff member to the database. So this is no longer an urgent high priority item

• Fixes Add staff member as authorized user for logging in/editing #321

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Joe-Ortiz]

Except for the UserManagementController, the other controllers should use the AdminOrStaff role for the Authorize instead of Admin from the IdentityHelper class

[Copilot]

Except for the UserManagementController, the other controllers should use the AdminOrStaff role for the Authorize instead of Admin from the IdentityHelper class

Done in commit 6b421c5. Updated ProgramVideosController, PeopleController, and AdminController to use AdminOrStaff. The Analytics nav link is also now shown to staff users (it was already inside the AdminOrStaff nav block so no unauthorized users can see it). UserManagementController remains Admin-only.