feat: add safe platform user management

[kauandotnet]

Summary

• add a token-free Better Auth admin facade for bounded user, role, ban, and target-session management
• add generalized TypeORM control-plane coordination with rolling organization-lock compatibility
• block raw admin routes and canonicalize request paths before route-policy matching
• fail closed for retained banned sessions and safely project hostile profile/member/device metadata
• preserve organization/member and self-session operability against stock Better Auth 1.6.26

Validation

• pnpm run check
• pnpm test: 349 Express and 349 Fastify tests
• pnpm run verify:pack
• PostgreSQL: 84 tests

Deliberate boundaries

No create-user, hard-delete, password, or impersonation facade is exposed. Stock listUsers error swallowing and unpaginated listUserSessions allocation remain documented upstream constraints.