Admins can grant or revoke admin rights in Settings (BL-0045)

New POST /api/admin/user/role {name, admin}: admin-only (checked on the
server), keeps the password and sessions, takes effect on the target's
current session at once, logs who changed whom. Revoking your own
rights is refused, so at least one admin always remains. Settings ->
Users & access shows "Make admin" / "Remove admin" next to every other
user, with a confirmation. Test: normal users and anonymous callers are
refused, input checks, promotion and revocation apply immediately and
are saved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server.js

@@ -735,6 +735,21 @@ const routes = {
     createUser(name, b.password, name === u.name || !!b.admin, true);
     return { ok: true };
   },
+  // Grant or revoke admin rights without touching the password. Admins only (checked here, not
+  // just hidden in the UI); nobody can revoke their own rights, so at least one admin always remains.
+  'POST /api/admin/user/role': ({ u, b }) => {
+    admin(u);
+    const name = String(b.name || '').trim().toLowerCase();
+    const target = db.users[name] || bad(404, 'No such user.');
+    if (typeof b.admin !== 'boolean') bad(400, 'admin must be true or false.');
+    if (name === u.name && !b.admin) bad(400, "You can't remove your own admin rights.");
+    if (!!target.admin !== b.admin) {
+      target.admin = b.admin;
+      save();
+      console.log(`[users] ${u.name} ${b.admin ? 'made' : 'removed'} ${name} ${b.admin ? 'an admin' : 'as admin'}`);
+    }
+    return { ok: true, name, admin: target.admin };
+  },
   'POST /api/admin/user/delete': ({ u, b }) => {
     admin(u);
     const name = String(b.name || '');