Add CWMS user role management panel

[krowvin]

Summary

• add a Users menu and landing page linking to User Lists and User Roles
• add office-scoped user role management with user search, stable pagination, and a labeled user count
• summarize office-user cards with friendly preset names and compact custom-role details
• provide cwms-cli-compatible read-only, read/write, and user-administrator presets plus a custom role table
• show CWMS database role definitions inline while keeping assignment state visible as a separate badge
• add contextual help, the cwms-cli role-management link, and a notice about the future authorization replacement
• integrate the Groundwork Water office selector, user hooks, shared role presets, and role descriptions

Role description source

The CDA roles endpoint currently returns role names without their definitions. Until CDA exposes those descriptions, the UI uses a temporary hard-coded map exported by Groundwork Water and sourced from cwms-database/schema/src/cwms/at_schema_sec.sql (cwms_sec_user_groups.user_group_desc). The fallback includes newer roles such as SHOW STACK TRACE; it will be replaced with CDA-provided descriptions when available.

Dependency gate

Depends on USACE-WaterManagement/groundwork-water#329.

Do not merge this PR until that Groundwork Water change is released and this branch is updated to consume the released package version. Local validation used the exact package build from that PR.

Validation

• npm test -- --run (8 tests)
• npm run lint
• npm run build
• browser testing with 75 mock users per office, including search, pagination, presets, custom roles, database descriptions, and responsive panel sizing

Screenshots

Users landing page

Role presets and office users

Custom role selection