fix(users): /api/admin/users always returns a FullUserDto[]

src/application/dtos/settings_dto.rs

@@ -108,14 +108,15 @@ pub struct AdminResetPasswordDto {
     pub new_password: String,
 }
 
-/// Query parameters for listing users
+/// Query parameters for listing users. `/api/admin/users` used to
+/// bifurcate on `?summary=` (flat `PublicUserDto` vs nested
+/// `FullUserDto`); that split was retired — the endpoint now always
+/// returns `FullUserDto`. Unknown query params are ignored, so
+/// existing callers still passing `?summary=true` keep working.
 #[derive(Debug, Serialize, Deserialize)]
 pub struct ListUsersQueryDto {
     pub limit: Option<i64>,
     pub offset: Option<i64>,
-    /// Return only the fields rendered by the paginated management table.
-    /// Defaults to `false` so existing API clients keep the full user shape.
-    pub summary: Option<bool>,
 }
 
 /// Query parameters for the admin sessions listing.

src/application/services/auth_application_service.rs

@@ -3247,7 +3247,7 @@ impl AuthApplicationService {
     /// out so that internal-user surfaces — system address book, OCS
     /// sharee search, etc. — never expose external identities. Admin
     /// surfaces that need the full list should call
-    /// [`list_users_including_external_with_perms`] instead.
+    /// [`list_user_summaries_including_external_with_perms`] instead.
     pub async fn list_users(
         &self,
         limit: i64,
@@ -3260,23 +3260,6 @@ impl AuthApplicationService {
             .collect())
     }
 
-    /// Admin-only: lists users including external (grant-only) recipients.
-    /// Used by the admin user-management UI.
-    pub async fn list_users_including_external_with_perms<A: AuthorizationEngine>(
-        &self,
-        authorization: &A,
-        caller_id: Uuid,
-        limit: i64,
-        offset: i64,
-    ) -> Result<Vec<PublicUserDto>, DomainError> {
-        self.require_admin_caller(authorization, caller_id).await?;
-        let users = self.user_storage.list_users(limit, offset, true).await?;
-        Ok(users
-            .into_iter()
-            .map(|u| PublicUserDto::new(u, false))
-            .collect())
-    }
-
     /// Admin-only user listing. Returns `Vec<FullUserDto>` — same
     /// `FullUserDto` shape [`SelfUserDto`] embeds, so the FE reads
     /// admin table rows and `/me` responses through identical field
@@ -3284,7 +3267,10 @@ impl AuthApplicationService {
     /// (`user.is_online`) so the admin table renders the vignette +
     /// green dot without per-row follow-up fetches to
     /// `/api/users/{id}` (the N+1 that motivated the widening — see
-    /// `docs/plan/userdto-refactor.md` § N+1).
+    /// `docs/plan/userdto-refactor.md` § N+1). This is the sole
+    /// admin-visible listing path; the former flat
+    /// `list_users_including_external_with_perms` variant was
+    /// retired when `?summary` was dropped.
     pub async fn list_user_summaries_including_external_with_perms<A: AuthorizationEngine>(
         &self,
         authorization: &A,
@@ -3362,8 +3348,8 @@ impl AuthApplicationService {
     // `interfaces/api/routes.rs::admin_router`) — but every admin
     // method here still calls `require_admin_caller` as a
     // defense-in-depth check, matching the pattern
-    // `list_users_including_external_with_perms` established. If a
-    // handler is ever wired outside the /admin subtree, the AuthZ
+    // `list_user_summaries_including_external_with_perms` established.
+    // If a handler is ever wired outside the /admin subtree, the AuthZ
     // still holds.
 
     /// List sessions for the admin panel. `user_id_filter = Some(uuid)`