feat: add encrypted sync user management

Adds full CRUD for sync users (create/list/detail/edit) behind admin
auth and CSRF protection. Passwords are encrypted at rest and never
decrypted into a template context; only emails may be decrypted for
display on the edit form. Blank password fields on edit preserve the
existing encrypted password.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/web/templates/dashboard.html

@@ -4,9 +4,16 @@
 
 {% block content %}
 <h1>Dashboard</h1>
+<p><a href="/users/new">Add user</a></p>
 <ul>
     {% for user in users %}
-    <li>{{ user }}</li>
+    <li>
+        <a href="/users/{{ user.id }}">{{ user.name }}</a>
+        &mdash; {{ "enabled" if user.enabled else "disabled" }}
+        &mdash; {{ user.health_state.value }}
+    </li>
+    {% else %}
+    <li>No users yet.</li>
     {% endfor %}
 </ul>
 {% endblock %}