feat(api): add user and access management endpoints

[alucero270]

feat(api): add user and access management endpoints

Summary

Expose the API endpoints needed to manage users, roles, and source-scoped access assignments.

Scope

• Files: API contracts, controllers, management docs as needed
• Components: user management API, role management, access assignment interfaces

Acceptance Criteria

• the API supports managing users and source-scoped access assignments
• management behaviors are documented clearly enough to test and verify
• the API respects the authorization model introduced in Milestone 6

Notes

• Keep this issue focused on management interfaces, not UI workflows