Admin: Manage Users page with Keycloak sync + research-group role picker #2486

Problem

Administrators currently have no UI to oversee, create, edit, or delete users. There is no way to import an existing Keycloak account by UUID, and the research-group add-members flow hardcodes the role to EMPLOYEE — there's no way to add a professor.

Proposal

Add an admin-only "Manage Users" page (route: /manage-users) that:

• Lists every user with paging, sort, and search across name, email, and university id.
• Supports role and research-group multi-select filters.
• Provides "Create User" and "Import from Keycloak" buttons.
• Lets the admin view and edit any user, with email and userId read-only.
• Lets the admin delete any user (except themselves) — Keycloak hard delete + the existing DB anonymise + delete pipeline.

Bundled: extend the research-group add-members flow with a role picker (PROFESSOR / EMPLOYEE, default EMPLOYEE).

Acceptance criteria

• Admin can perform all CRUD + import flows on /manage-users.
• Non-admin users (professor / employee / applicant) cannot reach the page.
• Self-delete is rejected with 400 + disabled UI control.
• Manage-members lets admins pick PROFESSOR or EMPLOYEE.