feat(admin): frontend dashboard complet pour #71

Page admin standalone + widgets temps réel + CRUD users via AdminPanel existant.

- frontend/admin.html : page admin (header + 4 sections : stats temps réel,
  audit logs, backups, gestion utilisateurs + footer)
- frontend/js/admin.js : module ES avec init(), connectSSE(), loadStatsOnce(),
  loadAuditLogs(), loadBackupStats(), renderStatsWidget(), renderAuditTable(),
  renderBackups() + helpers (formatBytes, formatUptime, severityColor)
- frontend/locales/{fr,en}.json : 36 clés admin.* identiques (diff vérifié)
- frontend/js/auth.js : adminRow.onclick redirige vers /admin.html (au lieu de
  AdminPanel.show() qui reste fonctionnel)
- tests/frontend/unit.test.mjs : 3 nouveaux tests (admin.js existe + exports + parse)
- tests/test_auth_api.py : 2 nouveaux tests smoke (PATCH + DELETE /api/auth/admin/users)

Vérifié :
- pytest : 494 passed, 5 skipped (492 baseline + 2 nouveaux)
- frontend unit : 7 passed (4 baseline + 3 admin)
- validate-imports : 30 modules validated (29 + admin.js)
- pane-manager JSDOM : 9/9 passed
- ruff check backend/ : All checks passed

tests/test_auth_api.py

@@ -221,6 +221,52 @@ class TestAdmin:
         data = resp.json()
         assert data["username"] == "testuser"
 
+    def test_patch_user(self, auth_client):
+        """PATCH /api/auth/admin/users/{username} updates fields."""
+        token = self._login_admin(auth_client)
+        # Create a user first, then patch it.
+        auth_client.post("/api/auth/admin/users", headers={
+            "Authorization": f"Bearer {token}",
+        }, json={
+            "username": "patchuser",
+            "password": "origpass",
+            "role": "user",
+            "vaults": ["TestVault"],
+        })
+        resp = auth_client.patch("/api/auth/admin/users/patchuser", headers={
+            "Authorization": f"Bearer {token}",
+        }, json={
+            "display_name": "Patched User",
+            "active": False,
+        })
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["display_name"] == "Patched User"
+        assert data["active"] is False
+
+    def test_delete_user(self, auth_client):
+        """DELETE /api/auth/admin/users/{username} removes the user."""
+        token = self._login_admin(auth_client)
+        # Create a throwaway user, then delete it.
+        auth_client.post("/api/auth/admin/users", headers={
+            "Authorization": f"Bearer {token}",
+        }, json={
+            "username": "deleteuser",
+            "password": "delpass",
+            "role": "user",
+            "vaults": ["TestVault"],
+        })
+        resp = auth_client.delete("/api/auth/admin/users/deleteuser", headers={
+            "Authorization": f"Bearer {token}",
+        })
+        assert resp.status_code == 200
+        # Confirm it's gone via list.
+        list_resp = auth_client.get("/api/auth/admin/users", headers={
+            "Authorization": f"Bearer {token}",
+        })
+        usernames = [u["username"] for u in list_resp.json()]
+        assert "deleteuser" not in usernames
+
     def test_logout(self, auth_client):
         token = self._login_admin(auth_client)
         resp = auth_client.post("/api/auth/logout", headers={