feat: admin can create users manually + disable registration (#85)

Backend:
- POST /api/admin/users — admin-only user creation endpoint
  - username & password required, email optional (auto-generated placeholder)
  - role, quota_bytes, active all configurable
  - creates personal folder automatically
- PUT /api/admin/users/{id}/password — admin password reset
- GET/PUT /api/admin/settings/registration — toggle public registration
  - Supports env var OXICLOUD_DISABLE_REGISTRATION override
  - Blocks POST /api/auth/register when disabled
- AdminCreateUserDto, AdminResetPasswordDto added to settings DTOs
- registration_enabled field added to DashboardStatsDto

Frontend (admin.html):
- 'Create User' button in Users tab with full modal form
  (username, password, email, role, quota)
- 'Reset Password' button per user in actions column
- 'Allow public self-registration' toggle in Dashboard > System
  with warning banner when disabled

Closes #85

src/application/services/admin_settings_service.rs

@@ -267,4 +267,37 @@ impl AdminSettingsService {
             provider_name_suggestion: suggestion,
         })
     }
+
+    // ========================================================================
+    // Registration Control
+    // ========================================================================
+
+    /// Check if public self-registration is enabled.
+    /// Priority: env var `OXICLOUD_DISABLE_REGISTRATION` > DB setting > default (true).
+    pub async fn get_registration_enabled(&self) -> bool {
+        // Env var override takes priority
+        if let Ok(val) = std::env::var("OXICLOUD_DISABLE_REGISTRATION") {
+            return !matches!(val.to_lowercase().as_str(), "true" | "1" | "yes");
+        }
+        // Check DB setting
+        match self.settings_repo.get("registration_enabled").await {
+            Ok(Some(val)) => val == "true",
+            _ => true, // default: enabled
+        }
+    }
+
+    /// Enable or disable public self-registration.
+    pub async fn set_registration_enabled(
+        &self,
+        enabled: bool,
+        updated_by: &str,
+    ) -> Result<(), DomainError> {
+        self.settings_repo.set(
+            "registration_enabled",
+            if enabled { "true" } else { "false" },
+            "general",
+            false,
+            Some(updated_by),
+        ).await
+    }
 }

src/application/services/auth_application_service.rs

@@ -602,6 +602,124 @@ impl AuthApplicationService {
     // Admin User Management Methods
     // ========================================================================
 
+    /// Admin-only: create a user bypassing registration guards.
+    pub async fn admin_create_user(
+        &self,
+        dto: crate::application::dtos::settings_dto::AdminCreateUserDto,
+    ) -> Result<UserDto, DomainError> {
+        // Validate username length
+        if dto.username.len() < 3 || dto.username.len() > 32 {
+            return Err(DomainError::new(
+                ErrorKind::InvalidInput, "User",
+                "Username must be between 3 and 32 characters".to_string(),
+            ));
+        }
+
+        // Check for duplicate username
+        if self.user_storage.get_user_by_username(&dto.username).await.is_ok() {
+            return Err(DomainError::new(
+                ErrorKind::AlreadyExists, "User",
+                format!("User '{}' already exists", dto.username),
+            ));
+        }
+
+        // Email: use provided or generate placeholder
+        let email = dto.email
+            .filter(|e| !e.trim().is_empty())
+            .unwrap_or_else(|| format!("{}@oxicloud.local", dto.username));
+
+        // Check email uniqueness
+        if self.user_storage.get_user_by_email(&email).await.is_ok() {
+            return Err(DomainError::new(
+                ErrorKind::AlreadyExists, "User",
+                format!("Email '{}' is already registered", email),
+            ));
+        }
+
+        // Validate password
+        if dto.password.len() < 8 {
+            return Err(DomainError::new(
+                ErrorKind::InvalidInput, "User",
+                "Password must be at least 8 characters long".to_string(),
+            ));
+        }
+
+        // Determine role
+        let role = match dto.role.as_deref() {
+            Some("admin") => UserRole::Admin,
+            _ => UserRole::User,
+        };
+
+        // Determine quota
+        let quota = dto.quota_bytes.unwrap_or_else(|| {
+            if role == UserRole::Admin { 107_374_182_400 } else { 1_073_741_824 }
+        });
+
+        // Hash password
+        let password_hash = self.password_hasher.hash_password(&dto.password)?;
+
+        // Create domain entity
+        let user = User::new(
+            dto.username.clone(),
+            email,
+            password_hash,
+            role,
+            quota,
+        ).map_err(|e| DomainError::new(
+            ErrorKind::InvalidInput, "User",
+            format!("Error creating user: {}", e),
+        ))?;
+
+        // Persist
+        let created = self.user_storage.create_user(user).await?;
+
+        // Deactivate if requested (User::new always sets active=true)
+        if let Some(false) = dto.active {
+            self.user_storage.set_user_active_status(created.id(), false).await?;
+        }
+
+        // Create personal folder
+        if let Some(folder_service) = &self.folder_service {
+            let folder_name = format!("My Folder - {}", dto.username);
+            match folder_service.create_folder(CreateFolderDto {
+                name: folder_name,
+                parent_id: None,
+            }).await {
+                Ok(folder) => {
+                    tracing::info!(
+                        "Personal folder created for admin-created user {}: {} (ID: {})",
+                        created.id(), folder.name, folder.id
+                    );
+                },
+                Err(e) => {
+                    tracing::error!(
+                        "Could not create personal folder for user {}: {}",
+                        created.id(), e
+                    );
+                }
+            }
+        }
+
+        tracing::info!("Admin created user: {} ({})", dto.username, created.id());
+        Ok(UserDto::from(created))
+    }
+
+    /// Admin-only: reset a user's password.
+    pub async fn admin_reset_password(
+        &self,
+        user_id: &str,
+        new_password: &str,
+    ) -> Result<(), DomainError> {
+        if new_password.len() < 8 {
+            return Err(DomainError::new(
+                ErrorKind::InvalidInput, "User",
+                "Password must be at least 8 characters long".to_string(),
+            ));
+        }
+        let hash = self.password_hasher.hash_password(new_password)?;
+        self.user_storage.change_password(user_id, &hash).await
+    }
+
     /// Get a single user by ID (for admin panel)
     pub async fn get_user_admin(&self, user_id: &str) -> Result<UserDto, DomainError> {
         let user = self.user_storage.get_user_by_id(user_id).await?;