fix: reject conversion of accounts with administrative privileges

- refuse converting members of the admin group and subadmins, both return 409
- add controller tests covering both rejection paths

Assisted-by: ClaudeCode:claude-fable-5
Signed-off-by: ernolf <raphael.gradenwitz@googlemail.com>

Author: ernolf

lib/Controller/UsersController.php

@@ -286,6 +286,12 @@ public function convert(string $userId): DataResponse {
 			], Http::STATUS_CONFLICT);
 		}
 
+		if ($this->groupManager->isAdmin($userId) || $this->subAdmin->isSubAdmin($user)) {
+			return new DataResponse([
+				'message' => $this->l10n->t('Accounts with administrative privileges cannot be converted to guests')
+			], Http::STATUS_CONFLICT);
+		}
+
 		try {
 			$this->conversionService->convertToGuest($user, $author);
 			$this->guestManager->setGuestQuota($user);

tests/unit/Controller/UsersControllerTest.php

@@ -803,6 +803,41 @@ public function testConvertAlreadyGuest(): void {
 		$this->assertEquals(Http::STATUS_CONFLICT, $response->getStatus());
 	}
 
+	public function testConvertRejectsAdmin(): void {
+		$this->userSession->method('getUser')->willReturn($this->createMock(IUser::class));
+
+		$user = $this->createMock(IUser::class);
+		$user->method('getBackendClassName')->willReturn('Database');
+		$user->method('getLastLogin')->willReturn(0);
+
+		$this->userManager->method('get')->with('karl')->willReturn($user);
+		$this->guestManager->method('isGuest')->with($user)->willReturn(false);
+		$this->groupManager->method('isAdmin')->with('karl')->willReturn(true);
+
+		$this->conversionService->expects($this->never())->method('convertToGuest');
+
+		$response = $this->controller->convert('karl');
+		$this->assertEquals(Http::STATUS_CONFLICT, $response->getStatus());
+	}
+
+	public function testConvertRejectsSubAdmin(): void {
+		$this->userSession->method('getUser')->willReturn($this->createMock(IUser::class));
+
+		$user = $this->createMock(IUser::class);
+		$user->method('getBackendClassName')->willReturn('Database');
+		$user->method('getLastLogin')->willReturn(0);
+
+		$this->userManager->method('get')->with('karl')->willReturn($user);
+		$this->guestManager->method('isGuest')->with($user)->willReturn(false);
+		$this->groupManager->method('isAdmin')->with('karl')->willReturn(false);
+		$this->subAdmin->method('isSubAdmin')->with($user)->willReturn(true);
+
+		$this->conversionService->expects($this->never())->method('convertToGuest');
+
+		$response = $this->controller->convert('karl');
+		$this->assertEquals(Http::STATUS_CONFLICT, $response->getStatus());
+	}
+
 	public function testConvertRejectsAccountThatLoggedIn(): void {
 		$this->userSession->method('getUser')->willReturn($this->createMock(IUser::class));