fix: address external review findings for admin roles

- Block renaming system roles (ADMIN/USER) and add user migration on rename
- Add input validation: name max-length, trim on update, duplicate name check
- Replace fragile String.includes error matching with prefix-based classification
- Catch MongoDB 11000 duplicate key in createRoleByName
- Add pagination (limit/offset/total) to getRoleMembersHandler
- Reverse delete order in deleteRoleByName — reassign users before deletion
- Add role existence check in removeRoleMember; drop unused createdAt select
- Add Array.isArray guard for permissions input; use consistent ?? coalescing
- Fix import ordering per AGENTS.md conventions
- Type-cast mongoose.models.User as Model<IUser> for proper TS inference
- Add comprehensive tests: rename guards, pagination, validation, 500 paths

api/server/routes/admin/roles.js

@@ -20,7 +20,9 @@ const handlers = createAdminRolesHandlers({
   deleteRoleByName: db.deleteRoleByName,
   findUser: db.findUser,
   updateUser: db.updateUser,
+  updateUsersByRole: db.updateUsersByRole,
   listUsersByRole: db.listUsersByRole,
+  countUsersByRole: db.countUsersByRole,
 });
 
 router.use(requireJwtAuth, requireAdminAccess);