feat: add admin panel with user, tag, and signup management

Phase 4 — Admin Panel:
- Admin dashboard with user/fave/pending-request counts
- User management: create with temp password, reset password,
  enable/disable accounts (prevents self-disable)
- Tag management: rename and delete tags
- Signup request management: approve (creates user with
  must-reset-password) and reject pending requests
- Site settings: site name, description, signup mode
  (open/requests/closed)
- All admin routes require both login and admin role
- SignupRequest model and full store (create, list pending,
  approve with user creation, reject)
- SetMustResetPassword method on UserStore for admin password resets

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/store/user.go

@@ -157,6 +157,21 @@ func (s *UserStore) UpdateProfile(userID int64, displayName, bio, profileVisibil
 	return err
 }
 
+// SetMustResetPassword sets or clears the must_reset_password flag.
+func (s *UserStore) SetMustResetPassword(userID int64, must bool) error {
+	val := 0
+	if must {
+		val = 1
+	}
+	_, err := s.db.Exec(
+		`UPDATE users SET must_reset_password = ?,
+			updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
+		WHERE id = ?`,
+		val, userID,
+	)
+	return err
+}
+
 // UpdateAvatar updates a user's avatar path.
 func (s *UserStore) UpdateAvatar(userID int64, avatarPath string) error {
 	_, err := s.db.Exec(