User Management

Admin-only user and role management.

RBAC scaffold

Roles: ADMIN, DOCTOR, REVIEWER. Implement secure server-side authorization.