feat: add role-based user management with live spreadsheet imports

[tilipim123]

What I built

This PR is my implementation of the Umanni full stack challenge. I chose the Hotwire path and stayed close to the Rails 8 stack instead of introducing a separate frontend or Redis dependency.

• Visitors can register, members are limited to their own profile, and administrators can search and manage accounts through a role-aware dashboard.
• CSV/XLSX imports run in Solid Queue, keep a durable result for each row, and publish progress through Solid Cable and Turbo Streams. Dashboard counters use the same real-time path.
• The application ships as a non-root, multi-stage Docker image with Thruster, PostgreSQL 17, ZJIT, a self-contained Compose setup, and a Kamal 2 configuration.

Design decisions

I kept the application as a modular monolith because users, permissions, imports, and dashboard statistics share the same data and transactional boundaries. Controllers only coordinate HTTP concerns; mutations live in focused services, reads in query objects, and PostgreSQL constraints back the important model invariants.

Two failure cases received extra attention: concurrent requests cannot remove the final administrator, and retries cannot duplicate rows that were already imported. Import history also survives account deletion by anonymizing creator/imported-user references at the database boundary.

How I verified it

The complete local gate is one command:

docker compose --profile tools run --rm test bin/ci

Latest result:

• 120 Rails tests and 497 assertions, with no failures, errors, or skips
• 4 Selenium/Chromium journeys and 26 assertions
• 99.63% merged line coverage and 89.58% branch coverage
• RuboCop, Zeitwerk, Brakeman, bundler-audit, importmap audit, and seed replant all passing
• final production-mode image rebuilt and started with Ruby 4.0.6, Rails 8.1.3.1, ZJIT, UID 1000, healthy web and worker services
• /, /up, /manifest, and /service-worker returning 200; a login POST without a CSRF token returning 422 with credentials filtered from logs
• interactive browser review covering registration/authentication, both roles, authorization denial, CRUD and role changes, responsive layouts, avatar feedback, CSV/XLSX imports, row failures, and real-time updates

The README contains the build, seed, run, configuration, and deployment instructions. Detailed evidence is in docs/qa-report.md; the acceptance inventory is in docs/qa-inventory.md.

AI usage

I used OpenAI Codex with GPT-5.6 Sol (gpt-5.6-sol) during architecture, implementation, testing, and review. I reviewed the generated changes and remained responsible for the final technical decisions. The disclosure is also the first section of the README, as required by the challenge.