feat(admin): users-management page with admin/agent role toggles

[mpge]

Summary

Port the admin Users management surface from the canonical Laravel reference (escalated-laravel#94) to escalated-wordpress for feature parity.

• New Escalated -> Users submenu page: lists WordPress users with their Escalated admin / agent state, search by name + email, paginated 20 per page, admins-first ordering.
• Per-row toggles to grant/revoke the escalated_admin and escalated_agent roles. Same self-demote guard and admin->agent cascade rules as the Laravel reference:
  • Promoting to admin also grants agent.
  • Revoking agent from an admin demotes them fully (avoids the "admin gate on, agent gate off" inconsistency).
  • You cannot revoke your own admin role.
• Gated by the existing escalated_user_manage capability (held by escalated_admin and the WP administrator role via Activator::add_admin_caps).

WordPress deviation: WP-native roles, not is_admin / is_agent columns

The Laravel reference flips is_admin / is_agent boolean columns on a host User row. This plugin does not -- and cannot, without forcing every WordPress site to alter wp_users. WordPress has a first-class role / capability system that every other Escalated admin gate in this plugin already uses (see Activator::create_roles and Activator::add_admin_caps), so the port toggles WP roles instead:

Laravel column	WordPress equivalent
is_admin = true	user has escalated_admin role (or WP administrator)
is_agent = true	user has escalated_agent role (or admin, since admins are agents)

The cascade and self-demote logic is identical to the Laravel reference; only the underlying write target differs. Admin_Users::user_is_admin / user_is_agent project the role state into the same {is_admin, is_agent} row shape the Vue reference page consumed.

Frontend deviation: no Vue SPA

escalated-wordpress does not consume the @escalated-dev/escalated Vue SPA (there is no top-level package.json); the plugin renders its admin screens with native WordPress templates under wp-admin. The new page therefore lives at templates/admin/users.php using wp-list-table markup rather than re-mounting Escalated/Admin/Users/Index.vue. The ^0.8.0 bump in the brief does not apply here.

Changes

• includes/Admin/class-admin-users.php -- new admin controller (render + handle_actions + pure update_role() for testability).
• templates/admin/users.php -- list + search + per-row role toggle forms.
• includes/Admin/class-admin-menu.php -- register the new submenu under escalated_user_manage.
• tests/Test_Admin_Users.php -- 7 PHPUnit cases mirroring tests/Feature/Admin/UserControllerTest.php in the Laravel reference.
• CHANGELOG.md -- [Unreleased] entry.

Test plan

• CI: Tests job (PHP 8.1, 8.2) green.
• CI: Lint job (Pint) green.
• Manual smoke (post-merge): visit wp-admin -> Escalated -> Users, search, toggle admin / agent on a non-self user, attempt self-demote (should fail), revoke agent on another admin (should clear both roles).

Reference: escalated-laravel#94