feat(admin): users and organizations admin verbs

[Bccorb]

Summary

Eighth issue in the CLI auth epic (#38). Adds terminal access to the instance admin endpoints for user and organization management, built on the authenticated client (#41). All commands require an admin role.

Commands

Users (/admin/users*):

• users list [--limit <n>] [--offset <n>] [--json]
• users delete <id> (confirmation; DELETE /admin/users with body { userId })
• users credentials <id> [--json] (from GET /admin/users/:id detail)
• users prepare-device-replacement <id> [--keep-sessions] [--keep-passkeys] [--keep-totp]

Organizations (/admin/organizations*):

• org list [--json], org create <name> [--slug], org get <id> [--json], org update <id> [--name] [--slug]
• org members list <orgId> [--json]
• org members add <orgId> (--user <id> | --email <email>) [--roles a,b] [--scopes a,b]
• org members update <orgId> <userId> [--roles a,b] [--scopes a,b]
• org members remove <orgId> <userId> (confirmation)

Notes / decisions

• Endpoint shapes from source: DELETE /admin/users takes the id in the body ({ userId }), not the path. Per-user credentials come from the GET /admin/users/:id detail response ({ user, sessions, credentials, events }); there is no dedicated per-user credential route (/admin/credential-count is a global count). Create/get/update org return an { organization } envelope; member add/update return { membership }. All unwrapped in the core layer.
• Paging: GET /admin/users has no server-side paging, so --limit/--offset slice the returned list client-side and the footer reports showing X-Y of total.
• Step-up: prepare-device-replacement also requires a step-up session (requireStepUp), which the CLI cannot establish yet. A 401/403 there is surfaced as a clear "requires an elevated step-up admin session, use the dashboard" message rather than a generic error.
• Permissions: every verb maps 403 to a clear permission error via a shared reporter.

Structure

• src/core/admin.ts: all admin network functions (listUsers, deleteUser, getUserDetail, prepareDeviceReplacement, listOrgs, createOrg, getOrg, updateOrg, listMembers, addMember, updateMember, removeMember), AdminApiError, reusing PermissionError.
• src/commands/users.ts, src/commands/org.ts, and a small shared adminShared.ts (error reporter + comma-list parser).

Tests / verification

• npm run build (tsc strict): passing.
• npm test (vitest): 81 passing (12 new): users list/delete (body userId)/404, credentials from detail, device-replacement step-up handling, 403 to PermissionError, org list/create/update envelope unwrap, member list/add/update/remove with encoded paths, and org 404.
• Smoke-tested dispatch, unknown-subcommand usage, not-logged-in handling, and help output.

Live end-to-end (admin login, then drive these) fits as a conformance spec under #47, now unblocked by the Node 24 Dockerfile fix (#50).

Acceptance criteria

• An admin can list and manage users and organizations from the CLI.
• A non-admin user receives a clear permission error.

Closes #46