feat(users): add GET /users endpoint for listing users

[totopoloco]

Description

This PR implements a new GET /users endpoint in the users controller that allows retrieving user information from the database.

Motivation

• Admin users (members of ADMIN_GROUPS like admin, ingestor) can retrieve all users in the database
• Regular authenticated users can only retrieve their own user information
• Unauthenticated users are denied access

Implementation details

1. New CASL Actions (src/casl/action.enum.ts)

• Added UserListAll - grants permission to list all users (admin only)
• Added UserListOwn - grants permission to list own user info (all authenticated users)

2. CASL Ability Factory (src/casl/casl-ability.factory.ts)

• Admin users (those in ADMIN_GROUPS) are granted UserListAll permission
• All authenticated users are granted UserListOwn permission
• Non-admin users are explicitly denied UserListAll

3. Users Service (src/users/users.service.ts)

• Added findAll() method that retrieves all users from the database

4. Users Controller (src/users/users.controller.ts)

• Added GET /users endpoint with proper guards and policy checks
• Uses CASL to determine if user can see all users or only their own

Changes

Unit Tests Added

Controller Tests (src/users/users.controller.spec.ts)

• Admin user returns all users
• Regular user returns only their own info
• Empty array when user not found in database
• Proper calls to userEndpointAccess
• DTO structure validation
• Verifies findAll service is not called for non-admin users

Service Tests (src/users/users.service.spec.ts)

• Returns array of users
• Returns empty array when no users exist
• Users have expected properties
• Handles multiple auth strategies (local, oidc)
• findById returns user or null appropriately

API Documentation

The endpoint is documented with Swagger decorators:

• @ApiOperation with summary and description
• @ApiResponse with status 200 and ReturnedUserDto[] type

Authorization Matrix

User Type	Access Level
Unauthenticated	Denied
Regular User	Own info only
Admin User (ADMIN_GROUPS)	All users

Tests included

• Included for each change/fix?
• Passing?

Documentation

• Swagger documentation updated (required for API changes)
• Official documentation updated

Official documentation info

N/A - No official documentation changes required for this PR.