feat: add encrypted sync user management

Adds full CRUD for sync users (create/list/detail/edit) behind admin
auth and CSRF protection. Passwords are encrypted at rest and never
decrypted into a template context; only emails may be decrypted for
display on the edit form. Blank password fields on edit preserve the
existing encrypted password.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/db/repositories.py

@@ -23,6 +23,15 @@ class UserRepository:
     def list_enabled(self) -> list[SyncUser]:
         return list(self.session.scalars(select(SyncUser).where(SyncUser.enabled.is_(True)).order_by(SyncUser.id)))
 
+    def list_all(self) -> list[SyncUser]:
+        return list(self.session.scalars(select(SyncUser).order_by(SyncUser.name)))
+
+    def update(self, user: SyncUser, **values) -> SyncUser:
+        for key, value in values.items():
+            setattr(user, key, value)
+        self.session.commit()
+        return user
+
 
 class ActivityRepository:
     def __init__(self, session: Session) -> None: