Admins can grant or revoke admin rights in Settings (BL-0045)

New POST /api/admin/user/role {name, admin}: admin-only (checked on the
server), keeps the password and sessions, takes effect on the target's
current session at once, logs who changed whom. Revoking your own
rights is refused, so at least one admin always remains. Settings ->
Users & access shows "Make admin" / "Remove admin" next to every other
user, with a confirmation. Test: normal users and anonymous callers are
refused, input checks, promotion and revocation apply immediately and
are saved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

public/settings.js

@@ -473,10 +473,16 @@
         h('div', { class: 'field' }, h('span', {}, 'Users'),
           h('div', { class: 'users' }, data.users.map(u => h('div', {},
             h('span', {}, u.name, u.admin ? h('span', { class: 'tag', style: 'margin-left:8px' }, 'admin') : null),
-            u.name === me.name ? h('span', { class: 'muted small' }, 'you') : h('button', { class: 'btn small', onclick: async () => {
-              if (!confirm(`Delete ${u.name} and their reading progress?`)) return;
-              await api('api/admin/user/delete', { name: u.name }); load();
-            } }, 'Delete'))))),
+            u.name === me.name ? h('span', { class: 'muted small' }, 'you') : h('span', { class: 'row' },
+              h('button', { class: 'btn small', onclick: async () => {
+                if (!confirm(u.admin ? `Remove admin rights from ${u.name}?` : `Make ${u.name} an admin? Admins can manage users, the library and the scraper.`)) return;
+                try { await api('api/admin/user/role', { name: u.name, admin: !u.admin }); load(); }
+                catch (e) { msg.textContent = e.message; msg.className = 'small error'; }
+              } }, u.admin ? 'Remove admin' : 'Make admin'),
+              h('button', { class: 'btn small', onclick: async () => {
+                if (!confirm(`Delete ${u.name} and their reading progress?`)) return;
+                await api('api/admin/user/delete', { name: u.name }); load();
+              } }, 'Delete')))))),
         h('div', { class: 'field' }, h('span', {}, 'Add a user or reset a password'),
           h('div', { class: 'row' }, name, pw, h('label', { class: 'row' }, isAdmin, 'admin'),
             h('button', { class: 'btn', onclick: async () => {