Add admin-only Settings -> Users page for creating accounts

Peter needed a second user for throwaway testing without going through
Django admin each time. Superusers now get a "Users" tab in Settings
(hidden for regular users) with a create-user form and a list of existing
accounts. New users are regular (non-staff, non-superuser) by default, with
an optional "Grant admin access" checkbox; creating one immediately issues
their API token and displays it once, since that's the credential an agent
account needs and a human account can otherwise regenerate for themselves
later from their own Settings -> Account.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/views/test_settings_users.py

@@ -0,0 +1,66 @@
+from django.contrib.auth import get_user_model
+from django.test import TestCase
+from django.urls import reverse
+from rest_framework.authtoken.models import Token
+
+User = get_user_model()
+
+
+class SettingsUsersViewTestCase(TestCase):
+    def setUp(self):
+        self.admin = User.objects.create_superuser(username="admin", password="pw", email="")
+        self.regular = User.objects.create_user(username="regular", password="pw")
+
+    def test_requires_login(self):
+        response = self.client.get(reverse("settings-users"))
+        self.assertEqual(response.status_code, 302)
+
+    def test_non_superuser_forbidden(self):
+        self.client.force_login(self.regular)
+        response = self.client.get(reverse("settings-users"))
+        self.assertEqual(response.status_code, 403)
+
+    def test_superuser_can_view(self):
+        self.client.force_login(self.admin)
+        response = self.client.get(reverse("settings-users"))
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "admin")
+        self.assertContains(response, "regular")
+
+    def test_superuser_creates_regular_user_with_token(self):
+        self.client.force_login(self.admin)
+        response = self.client.post(
+            reverse("settings-users"), {"username": "newtester", "password": "hunter2pw"}
+        )
+        self.assertEqual(response.status_code, 200)
+
+        created = User.objects.get(username="newtester")
+        self.assertTrue(created.check_password("hunter2pw"))
+        self.assertFalse(created.is_superuser)
+        self.assertFalse(created.is_staff)
+        self.assertTrue(Token.objects.filter(user=created).exists())
+        self.assertContains(response, Token.objects.get(user=created).key)
+
+    def test_superuser_can_grant_admin(self):
+        self.client.force_login(self.admin)
+        self.client.post(
+            reverse("settings-users"),
+            {"username": "newadmin", "password": "hunter2pw", "is_superuser": "on"},
+        )
+        created = User.objects.get(username="newadmin")
+        self.assertTrue(created.is_superuser)
+
+    def test_duplicate_username_rejected(self):
+        self.client.force_login(self.admin)
+        response = self.client.post(
+            reverse("settings-users"), {"username": "regular", "password": "hunter2pw"}
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "already exists")
+        self.assertEqual(User.objects.filter(username="regular").count(), 1)
+
+    def test_missing_fields_rejected(self):
+        self.client.force_login(self.admin)
+        response = self.client.post(reverse("settings-users"), {"username": "", "password": ""})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "required")