fix: prevent privilege escalation via client-supplied role in request…

[vishu9334]

What changed

• Defined userPayloadSchema using Zod .strip() to whitelist safe user fields and drop unpermitted fields like role and isAdmin.
• Updated POST /api/admin/users to parse requests through this schema so client payloads cannot grant admin access.
• Updated src/app.test.ts from test.fails to test and added test coverage against alternative privilege escalation payloads.

Why

• Addresses challenge challenges/admin-endpoint-trusts-client-provided-role.md.
• Prevented privilege escalation where an unauthenticated client could set role: "admin" in the request body to gain admin rights.

Validation

• npm test (all 4 tests passing)
• npm run build

Risks

• Separate Trust-Boundary Gap: POST /api/admin/users does not yet require caller authentication/authorization (requireAuth). Any unauthenticated client can still reach the endpoint.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}