feat: register the Users admin screen with the privileged-member guard

- permissions (the four Winter codes and manage_privileged_groups),
  the user navigation item and the embedded admin YAML
- Users controller: list with deactivated users, row states, the
  groups, created date and activated filters, and the form's name,
  surname and email
- a member of a group in golem15.user.privileged_groups (default
  admin) keeps their email, password and row unless the administrator
  holds golem15.users.manage_privileged_groups; the refusal is a 403
  that saves nothing

admin_permissions.go

@@ -0,0 +1,49 @@
+package user
+
+import (
+	"git.golem15.com/golem15/sm-user-plugin/classes"
+	"git.golem15.com/golem15/sm-user-plugin/controllers"
+	"git.golem15.com/golem15/summercms/modules/pact"
+)
+
+const userPermissionTab = "golem15.user::lang.plugin.tab"
+
+// Permissions is the plugin's Winter registerPermissions() catalog plus one
+// code of its own. The four PHP codes default to the developer role;
+// impersonate_user is registered so imported backend roles that name it stay
+// valid, although no screen uses it. manage_privileged_groups has no default
+// role: only a superuser, or a role that was granted it explicitly, may
+// change the email or password of a privileged-group member or delete one.
+func (*Plugin) Permissions() []pact.Permission {
+	return []pact.Permission{
+		{
+			Code:  controllers.PermissionAccessUsers,
+			Tab:   userPermissionTab,
+			Label: "golem15.user::lang.plugin.access_users",
+			Roles: []string{"developer"},
+		},
+		{
+			Code:  "golem15.users.access_groups",
+			Tab:   userPermissionTab,
+			Label: "golem15.user::lang.plugin.access_groups",
+			Roles: []string{"developer"},
+		},
+		{
+			Code:  "golem15.users.access_settings",
+			Tab:   userPermissionTab,
+			Label: "golem15.user::lang.plugin.access_settings",
+			Roles: []string{"developer"},
+		},
+		{
+			Code:  "golem15.users.impersonate_user",
+			Tab:   userPermissionTab,
+			Label: "golem15.user::lang.plugin.impersonate_user",
+			Roles: []string{"developer"},
+		},
+		{
+			Code:  classes.PermissionManagePrivilegedGroups,
+			Tab:   userPermissionTab,
+			Label: "golem15.user::lang.plugin.manage_privileged_groups",
+		},
+	}
+}