Add Storage, Users, Secrets, Webhooks, Scheduled tasks, Audit log screens

Full management surfaces for the platform-admin tenant, mirroring the
existing Tenants pattern (DataTable + row actions + create/edit dialogs +
ConfirmDialog for destructive ops, all data-action tagged for the
command bus, useRegisterAdminContext publishing for the assistant).

- Storage (/storage): backends + credentials. Write-only secret fields,
  Validate/Activate/Deactivate/Set-default/Mark-degraded/Maintenance.
- Users (/users): tabs for Users, Invitations, Roles. Per-user View
  drawer with profile, role add/remove, API keys (one-time reveal on
  create), usage + quota.
- Secrets (/secrets): /api/v1/admin/secrets — create/rotate/rollback,
  versions dialog, enable/disable, generate-value helper.
- Webhooks (/webhooks): CRUD, pause/resume, regenerate-secret with
  one-time reveal, send test event, deliveries dialog.
- Scheduled tasks (/scheduled-tasks): cron CRUD, run-now trigger,
  enable/disable, expandable run history.
- Audit log (/activity): replaces the empty stub. Filter by severity,
  resource type, date range; click for full JSON detail.

All endpoints are hand-rolled HTTP because most aren't covered by the
generated OpenAPI typed paths yet — switch to arcadia.typed.* when the
backend wires them into OpenApiSpex.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/lib/arcadia/users.ts

@@ -0,0 +1,111 @@
+// Arcadia users API helpers.
+//
+// Backed by /api/v1/users (resources route). The OpenAPI spec doesn't yet
+// describe these operations as typed paths, so we hand-roll types and use
+// the generic verb methods on the client. Same pattern as tenants.ts.
+
+import type { ArcadiaClient } from "@crema/arcadia-client"
+
+export type UserStatus = "active" | "inactive" | "suspended"
+
+export interface UserRoleSummary {
+  id: string
+  slug: string
+  name: string
+  permissions: string[]
+}
+
+export interface User {
+  id: string
+  email: string
+  first_name: string | null
+  last_name: string | null
+  full_name: string
+  status: UserStatus
+  email_verified: boolean
+  email_verified_at: string | null
+  last_sign_in_at: string | null
+  tenant_id: string
+  roles: UserRoleSummary[]
+  inserted_at: string
+  updated_at: string
+}
+
+export interface UserListParams {
+  status?: UserStatus
+  email_verified?: boolean
+}
+
+export interface UserInput {
+  email: string
+  first_name?: string | null
+  last_name?: string | null
+  status?: UserStatus
+  password?: string
+  role_ids?: string[]
+}
+
+export async function listUsers(
+  arcadia: ArcadiaClient,
+  params?: UserListParams,
+): Promise<User[]> {
+  const queryParams = params
+    ? {
+        status: params.status,
+        email_verified: params.email_verified == null ? undefined : String(params.email_verified),
+      }
+    : undefined
+  const res = await arcadia.GET<{ data: User[] }>("/api/v1/users", { params: queryParams })
+  return res.data
+}
+
+export async function getUser(arcadia: ArcadiaClient, id: string): Promise<User> {
+  const res = await arcadia.GET<{ data: User }>(`/api/v1/users/${id}`)
+  return res.data
+}
+
+export async function createUser(arcadia: ArcadiaClient, input: UserInput): Promise<User> {
+  const res = await arcadia.POST<{ data: User }>("/api/v1/users", { body: { user: input } })
+  return res.data
+}
+
+export async function updateUser(
+  arcadia: ArcadiaClient,
+  id: string,
+  input: Partial<UserInput>,
+): Promise<User> {
+  const res = await arcadia.PATCH<{ data: User }>(`/api/v1/users/${id}`, {
+    body: { user: input },
+  })
+  return res.data
+}
+
+export async function deleteUser(arcadia: ArcadiaClient, id: string): Promise<void> {
+  await arcadia.DELETE(`/api/v1/users/${id}`)
+}
+
+export async function assignRole(
+  arcadia: ArcadiaClient,
+  userId: string,
+  roleId: string,
+): Promise<User> {
+  const res = await arcadia.POST<{ data: User }>(`/api/v1/users/${userId}/roles/${roleId}`)
+  return res.data
+}
+
+export async function removeRole(
+  arcadia: ArcadiaClient,
+  userId: string,
+  roleId: string,
+): Promise<User> {
+  const res = await arcadia.DELETE<{ data: User }>(`/api/v1/users/${userId}/roles/${roleId}`)
+  return res.data
+}
+
+export async function setUserStatus(
+  arcadia: ArcadiaClient,
+  id: string,
+  status: UserStatus,
+): Promise<User> {
+  return updateUser(arcadia, id, { status })
+}