Add Administration user management: list, password reset, email change, group assignments

Wires the previously-unused fis_admin_* user/group stored procs into the Admin
module (fds_sys-gated), adds a users grid with a per-row ribbon (reset
password, change email, manage group membership), and always emails a
password reset result to the user rather than showing it to the admin.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Fuchs.Tests/AdminUserManagementTests.cs

@@ -0,0 +1,43 @@
+using Fuchs.Controllers;
+using Xunit;
+
+namespace Fuchs.Tests;
+
+/// <summary>
+/// Covers the pure (non-DB) logic behind the Admin module's user-management endpoints —
+/// specifically the admin-initiated password-reset notification content, since the SQL-bound
+/// parts of IntranetController.Admin.cs (fis_admin_* proc calls) can't be unit-tested per
+/// repo convention and require a running database.
+/// </summary>
+public class AdminUserManagementTests
+{
+    [Fact]
+    public void BuildPasswordResetEmail_ValidInput_ContainsNameAndPassword()
+    {
+        var (subject, html) = IntranetController.BuildPasswordResetEmail("Max Mustermann", "Ab12Cd34");
+
+        Assert.Contains("Passwort", subject);
+        Assert.Contains("Max Mustermann", html);
+        Assert.Contains("Ab12Cd34", html);
+    }
+
+    [Theory]
+    [InlineData("<script>alert(1)</script>", "&lt;script&gt;alert(1)&lt;/script&gt;")]
+    [InlineData("O'Brien&Co", "O&#39;Brien&amp;Co")]
+    public void BuildPasswordResetEmail_PasswordWithHtmlSpecialChars_IsHtmlEncoded(string rawPassword, string encoded)
+    {
+        var (_, html) = IntranetController.BuildPasswordResetEmail("Test User", rawPassword);
+
+        Assert.Contains(encoded, html);
+        Assert.DoesNotContain(rawPassword, html);
+    }
+
+    [Fact]
+    public void BuildPasswordResetEmail_EmptyName_StillProducesValidContent()
+    {
+        var (subject, html) = IntranetController.BuildPasswordResetEmail("", "somepassword");
+
+        Assert.False(string.IsNullOrWhiteSpace(subject));
+        Assert.Contains("somepassword", html);
+    }
+}