- Add viewer role to backend enum + Alembic migration
- SSO auto-provisioned users now get viewer (lowest privilege) by default
- Wire admin/users page to real API (replace mock data), with add/edit/deactivate
- Fix frontend UserRole enum to match backend (TM_MANAGER, REVIEWER)
- Replace hardcoded mock user in Sidebar with real auth, filter admin-only nav items, wire logout
- Add seed script to set default admins (daveporter, vadymsamoilenko)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Scans storage/amazon/tm/ and storage/amazon/ref/, creates DB registry
entries for each JSON file so they appear in the TM Registry and
Reference Library pages. Extracts channel from TM filenames, locale
from ref filenames, counts JSONL segments. Idempotent (skips duplicates).
Also added to deploy.sh --init flow.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>