Add admin-only Settings -> Users page for creating accounts

Peter needed a second user for throwaway testing without going through
Django admin each time. Superusers now get a "Users" tab in Settings
(hidden for regular users) with a create-user form and a list of existing
accounts. New users are regular (non-staff, non-superuser) by default, with
an optional "Grant admin access" checkbox; creating one immediately issues
their API token and displays it once, since that's the credential an agent
account needs and a human account can otherwise regenerate for themselves
later from their own Settings -> Account.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

artifacts/urls.py

@@ -16,6 +16,7 @@ urlpatterns = [
     path("api/artifacts/<str:artifact_id>", views.ArtifactDetailView.as_view(), name="artifact-detail-api"),
     path("settings/", views.settings_home, name="settings-home"),
     path("settings/account/", views.settings_account, name="settings-account"),
+    path("settings/users/", views.settings_users, name="settings-users"),
     path("settings/demo-data/", views.settings_demo_data, name="settings-demo-data"),
     path("settings/storage/", views.settings_storage, name="settings-storage"),
 ]

artifacts/views.py

@@ -13,6 +13,7 @@ from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import views as auth_views
 from django.contrib.auth.decorators import login_required
+from django.contrib.auth.models import User
 from django.db.models import Count, Q, Sum
 from django.http import FileResponse, Http404, HttpResponse, HttpResponseForbidden, JsonResponse
 from django.shortcuts import get_object_or_404, redirect, render
@@ -842,6 +843,41 @@ def settings_account(request):
     )
 
 
+@login_required
+def settings_users(request):
+    if not request.user.is_superuser:
+        return HttpResponseForbidden("Admin access required")
+
+    created_user = None
+    created_token = None
+    if request.method == "POST":
+        username = request.POST.get("username", "").strip()
+        password = request.POST.get("password", "")
+        grant_admin = request.POST.get("is_superuser") == "on"
+        if not username or not password:
+            messages.error(request, "Username and password are required.")
+        elif User.objects.filter(username=username).exists():
+            messages.error(request, f"A user named '{username}' already exists.")
+        else:
+            created_user = User.objects.create_user(username=username, password=password)
+            if grant_admin:
+                created_user.is_superuser = True
+                created_user.save(update_fields=["is_superuser"])
+            created_token = Token.objects.create(user=created_user)
+            messages.success(request, f"Created user '{username}'.")
+
+    return render(
+        request,
+        "artifacts/settings_users.html",
+        {
+            "active_section": "users",
+            "users": User.objects.order_by("username"),
+            "created_user": created_user,
+            "created_token": created_token,
+        },
+    )
+
+
 @login_required
 def settings_demo_data(request):
     if request.method == "POST":