feat: implement user role status toggle and reset password functionality

- Added toggle functionality for user roles (activate/deactivate) in roles and users pages.
- Introduced a reset password page that validates and updates user passwords via a reset link.
- Enhanced user detail page with edit functionality for user information (display name, email, mobile number).
- Implemented sending reset link feature for users, with appropriate error handling and success notifications.
- Updated API endpoints for user management to support new functionalities.
- Improved UI components for better user experience during status updates and password changes.

Backend/ERPCore/Infra/Auth/AuthHex/AuthHexClient.cs

@@ -93,16 +93,35 @@ public sealed class AuthHexClient : IAuthHexClient
         => CallAsync<TwoFaStatusResponse>("user", "getTwoFAStatus", new { }, bearerToken, ct);
 
     public Task<DeleteAuthHexUserResult> DeleteUserAsync(string? email, string? mobileNumber, string? nic, string? username, CancellationToken ct)
-    {
-        var adminApiKey = _config["AuthHex:AdminApiKey"];
-        if (string.IsNullOrEmpty(adminApiKey))
-            throw new DomainException(ErrorCodes.AuthUpstreamError, "AuthHex:AdminApiKey is not configured — cannot call the admin deleteUser function.", 500);
-
-        return CallAsync<DeleteAuthHexUserResult>(
+        => CallAsync<DeleteAuthHexUserResult>(
             "user", "deleteUser",
             new { email, mobileNumber, nic, userName = username },
             null, ct,
-            extraHeaders: new Dictionary<string, string> { ["X-Admin-Api-Key"] = adminApiKey });
+            extraHeaders: AdminHeaders());
+
+    public Task<UserSummaryDto?> AdminUpdateUserAsync(Guid userId, AdminUpdateUserRequest request, CancellationToken ct)
+        => CallAsync<UserSummaryDto?>(
+            "user", "AdminUpdateUser",
+            new { userId, request.FullName, request.UserName, request.Email, request.MobileNumber },
+            null, ct,
+            extraHeaders: AdminHeaders());
+
+    public Task<UserSummaryDto?> AdminSetUserStatusAsync(Guid userId, bool isActive, CancellationToken ct)
+        => CallAsync<UserSummaryDto?>(
+            "user", "AdminSetUserStatus",
+            new { userId, isActive },
+            null, ct,
+            extraHeaders: AdminHeaders());
+
+    /// <summary>Shared guard for every admin-only AuthHex function — throws up front rather
+    /// than leaving a misconfigured deployment to fail opaquely on the network call.</summary>
+    private Dictionary<string, string> AdminHeaders()
+    {
+        var adminApiKey = _config["AuthHex:AdminApiKey"];
+        if (string.IsNullOrEmpty(adminApiKey))
+            throw new DomainException(ErrorCodes.AuthUpstreamError, "AuthHex:AdminApiKey is not configured — cannot call this admin function.", 500);
+
+        return new Dictionary<string, string> { ["X-Admin-Api-Key"] = adminApiKey };
     }
 
     // ---- RecoveryManager ------------------------------------------------

Backend/ERPCore/Infra/Auth/AuthHex/IAuthHexClient.cs

@@ -38,6 +38,15 @@ public interface IAuthHexClient
     /// </summary>
     Task<DeleteAuthHexUserResult> DeleteUserAsync(string? email, string? mobileNumber, string? nic, string? username, CancellationToken ct);
 
+    /// <summary>Admin-only: updates another user's identity fields (not self-service —
+    /// <see cref="UpdateUserAsync"/> only ever touches the caller's own account).
+    /// Gated by AuthHex:AdminApiKey.</summary>
+    Task<UserSummaryDto?> AdminUpdateUserAsync(Guid userId, AdminUpdateUserRequest request, CancellationToken ct);
+
+    /// <summary>Admin-only: activates/deactivates another user's AuthHex identity and, when
+    /// deactivating, invalidates their live sessions. Gated by AuthHex:AdminApiKey.</summary>
+    Task<UserSummaryDto?> AdminSetUserStatusAsync(Guid userId, bool isActive, CancellationToken ct);
+
     // RecoveryManager (POST /api/recovery)
     Task<ForgotPasswordResponse> ForgotPasswordAsync(ForgotPasswordRequest request, CancellationToken ct);
     Task<VerifyRecoveryOtpResponse> VerifyRecoveryOtpAsync(VerifyRecoveryOtpRequest request, CancellationToken ct);