[Admin][API] Users — cross-user list + detail #30

[Admin][API] Users — cross-user list + detail

Why

There is no way to see all platform users. dashboard.ts/usage.ts are hard-scoped to session.uid. The admin stub's "All Users" table has no backing endpoint.

Scope

• GET /v1/admin/users (behind requireAdmin, paginated + searchable by login/name/id): returns each user with id, github_login, github_name, avatar_url, roles, created_at, last_seen_at, subscription_status, plus counts: agents owned, active instances, API keys stored (provider names only — never key material), 30-day AI spend (from ai_usage).
• GET /v1/admin/users/:id — detail: profile + roles + owned agents + subscribed instances + stored key providers + recent usage/spend + recent errors for that user.
• Parameterized SQL only. Never return decrypted keys/credentials/tokens.

Acceptance criteria

• List paginates and searches; totals correct.
• Detail aggregates agents/instances/keys/usage for one user.
• Non-admin → 403. Response contains no secret material (keys, credentials, Gmail refresh token).
• Unit tests for scoping + admin gate.

Relevant code

• workers/api/src/routes/ (new admin.ts or admin-users.ts)
• Tables: users, agents, agent_instances, user_api_keys, ai_usage

References

• FGS /api/allusers (fgs/admin/src/index.ts), FAS /v1/admin/users (content-admin.ts).

Part of the PAGS Admin Portal epic. Depends on Foundation.