feat: document user management system and RBAC implementation

- Update copilot-instructions.md with user model, API routes, and frontend patterns
- Update README.md with RBAC details, user management API, and security sections
- Add user management technical documentation to TECH-CHANGELOG.md
- Bump version to 2025.1.0-alpha.13 with user management changelog entries

.github/copilot-instructions.md

@@ -104,6 +104,7 @@ Keep docs synced with code. When you change services/MQTT/API/UTC/env or dev/pro
   - API builds its engine in `server/database.py` (loads `.env` only in development).
   - Scheduler loads `DB_CONN` in `scheduler/db_utils.py`. Recurring events are expanded for the next 7 days, and event exceptions (skipped dates, detached occurrences) are respected. Only recurring events with recurrence_end in the future remain active. The scheduler publishes only events that are active at the current time and clears retained topics (publishes `[]`) for groups without active events. Time comparisons are UTC and naive timestamps are normalized.
   - Listener also creates its own engine for writes to `clients`.
+  - Scheduler queries a future window (default: 7 days) to expand recurring events using RFC 5545 rules, applies event exceptions (skipped dates, detached occurrences), and publishes only events that are active at the current time (UTC). When a group has no active events, the scheduler clears its retained topic by publishing an empty list. Time comparisons are UTC; naive timestamps are normalized. Logging is concise; conversion lookups are cached and logged only once per media.
 - MQTT topics (paho-mqtt v2, use Callback API v2):
   - Discovery: `infoscreen/discovery` (JSON includes `uuid`, hw/ip data). ACK to `infoscreen/{uuid}/discovery_ack`. See `listener/listener.py`.
   - Heartbeat: `infoscreen/{uuid}/heartbeat` updates `Client.last_alive` (UTC).
@@ -122,6 +123,12 @@ Keep docs synced with code. When you change services/MQTT/API/UTC/env or dev/pro
   - Storage: originals under `server/media/…`, outputs under `server/media/converted/` (prod compose mounts a shared volume for this path).
 
 ## Data model highlights (see `models/models.py`)
+- User model: Includes 7 new audit/security fields (migration: `4f0b8a3e5c20_add_user_audit_fields.py`):
+  - `last_login_at`, `last_password_change_at`: TIMESTAMP (UTC) tracking for auth events
+  - `failed_login_attempts`, `last_failed_login_at`: Security monitoring for brute-force detection
+  - `locked_until`: TIMESTAMP placeholder for account lockout (infrastructure in place, not yet enforced)
+  - `deactivated_at`, `deactivated_by`: Soft-delete audit trail (FK self-reference); soft deactivation is the default, hard delete superadmin-only
+  - Role hierarchy (privilege escalation enforced): `user` < `editor` < `admin` < `superadmin`
 - System settings: `system_settings` key–value store via `SystemSetting` for global configuration (e.g., WebUntis/Vertretungsplan supplement-table). Managed through routes in `server/routes/system_settings.py`.
   - Presentation defaults (system-wide):
     - `presentation_interval` (seconds, default "10")
@@ -157,6 +164,14 @@ Keep docs synced with code. When you change services/MQTT/API/UTC/env or dev/pro
     - `GET /api/academic_periods/active` — currently active period
     - `POST /api/academic_periods/active` — set active period (deactivates others)
     - `GET /api/academic_periods/for_date?date=YYYY-MM-DD` — period covering given date
+  - User management: `server/routes/users.py` exposes comprehensive CRUD for users (admin+):
+    - `GET /api/users` — list all users (role-filtered: admin sees user/editor/admin, superadmin sees all); includes audit fields in camelCase (lastLoginAt, lastPasswordChangeAt, failedLoginAttempts, deactivatedAt, deactivatedBy)
+    - `POST /api/users` — create user with username, password (min 6 chars), role, and status; admin cannot create superadmin; initializes audit fields
+    - `GET /api/users/<id>` — get detailed user record with all audit fields
+    - `PUT /api/users/<id>` — update user (cannot change own role/status; admin cannot modify superadmin accounts)
+    - `PUT /api/users/<id>/password` — admin password reset (requires backend check to reject self-reset for consistency)
+    - `DELETE /api/users/<id>` — hard delete (superadmin only, with self-deletion check)
+  - Auth routes (`server/routes/auth.py`): Enhanced to track login events (sets `last_login_at`, resets `failed_login_attempts` on success; increments `failed_login_attempts` and `last_failed_login_at` on failure). Self-service password change via `PUT /api/auth/change-password` requires current password verification.
 
   Documentation maintenance: keep this file aligned with real patterns; update when routes/session/UTC rules change. Avoid long prose; link exact paths.
 
@@ -195,9 +210,24 @@ Keep docs synced with code. When you change services/MQTT/API/UTC/env or dev/pro
   - Unified toast/dialog wording; replaced legacy alerts with toasts; spacing handled via inline styles to avoid Tailwind dependency.
 
 - Header user menu (top-right):
-  - Shows current username and role; click opens a menu with “Profil” and “Abmelden”.
+  - Shows current username and role; click opens a menu with "Passwort ändern" (lock icon), "Profil", and "Abmelden".
   - Implemented with Syncfusion DropDownButton (`@syncfusion/ej2-react-splitbuttons`).
-  - “Abmelden” navigates to `/logout`; the page invokes backend logout and redirects to `/login`.
+  - "Passwort ändern": Opens self-service password change dialog (available to all authenticated users); requires current password verification, new password min 6 chars, must match confirm field; calls `PUT /api/auth/change-password`
+  - "Abmelden" navigates to `/logout`; the page invokes backend logout and redirects to `/login`.
+
+- User management page (`dashboard/src/users.tsx`):
+  - Full CRUD interface for managing users (admin+ only in menu); accessible via "Benutzer" sidebar entry
+  - Syncfusion GridComponent: 20 per page (configurable), sortable columns (ID, username, role), custom action button template with role-based visibility
+  - Statistics cards: total users, active (non-deactivated), inactive (deactivated) counts
+  - Dialogs: Create (username/password/role/status), Edit (with self-edit protections), Password Reset (admin only, no current password required), Delete (superadmin only, self-check), Details (read-only audit info with formatted timestamps)
+  - Role badges: Color-coded display (user: gray, editor: blue, admin: green, superadmin: red)
+  - Audit information displayed: last login, password change, last failed login, deactivation timestamps and deactivating user
+  - Role-based permissions (enforced backend + frontend):
+    - Admin: can manage user/editor/admin roles (not superadmin); soft-deactivate only; cannot see/edit superadmin accounts
+    - Superadmin: can manage all roles including other superadmins; can permanently hard-delete users
+  - Security rules enforced: cannot change own role, cannot deactivate own account, cannot delete self, cannot reset own password via admin route (must use self-service)
+  - API client in `dashboard/src/apiUsers.ts` for all user operations (listUsers, getUser, createUser, updateUser, resetUserPassword, deleteUser)
+  - Menu visibility: "Benutzer" menu item only visible to admin+ (role-gated in App.tsx)
 
 - Settings page (`dashboard/src/settings.tsx`):
   - Structure: Syncfusion TabComponent with role-gated tabs