Reintroduce user update api path

[spacehamster87]

Reintroduced user update via REST API. Marked as draft for refinement or discussion before merging.

Details

• POST via r.Post("/user/{id}", api.updateUserByRequest) in rest.go:83.
• Uses username query param ( {id} ) and JSON Payload (UpdateUserAPIRequest).
• Secured via TokenAuth and additional APIAllowedIPs array if configured.

Caveats

• Updates are handled as single changes for one defined user-id, i.e.
  • Post to /user/user001 using
    • Payload {"add-role": "user"} or
    • Payload {"remove-role": "user"} or
    • Payload {"add-project": "abcd100"} or
    • Payload {"remove-project": "abcd100"}
• Token User requires both API and Admin roles at the moment, similar to form based updates in admin frontend interface

Summary Table

Token roles	AuthAPI	Handler	Result
[API] only	✓ passes	403 Forbidden	known intentional block
[Admin, API]	✓ passes	✓ passes	only working path
[Admin] only	401 Unauthorized	—	blocked at middleware
no roles / other	401 Unauthorized	—	blocked at middleware