fix(security): invalidate tokens on password change, enforce session timeout, fix role update

- Set password_changed_at when changing password via adminAuth route so
  existing JWT tokens are rejected by the auth middleware check
- Enforce session timeout on first request with unseen tokens by checking
  token iat against configured timeout (prevents bypass after server restart)
- Convert camelCase roleId/isActive to snake_case role_id/is_active in
  frontend updateUser service (fixes silent role update failures)

Resolves GHSA-rqg3-47p5-vgwg

frontend/src/services/userManagement.service.ts

@@ -149,7 +149,11 @@ export const userManagementService = {
    * Update an admin user
    */
   async updateUser(id: number, data: UpdateUserData): Promise<AdminUser> {
-    const response = await api.put<UpdateUserResponse>(`/admin/users/${id}`, data);
+    // Convert camelCase to snake_case for backend API
+    const payload: Record<string, unknown> = {};
+    if (data.roleId !== undefined) payload.role_id = data.roleId;
+    if (data.isActive !== undefined) payload.is_active = data.isActive;
+    const response = await api.put<UpdateUserResponse>(`/admin/users/${id}`, payload);
     return transformUser(response.data.user);
   },