[BE-118] Unit tests for the users module

[mftee]

Overview

backend/src/users/ has 3 files, 1 entity, and no tests. It owns identity and role data that every authorization decision depends on.

Tasks

• Test CRUD: create, find by id and email (found and not found), update, delete.
• Test that password or equivalent sensitive fields never appear in any returned object — assert on the serialized result, not just the entity.
• Test role assignment and that a user cannot escalate their own role through a profile update.
• Test uniqueness enforcement on email, including the concurrent-create case.
• Mock repositories; target ≥75% coverage.

Acceptance Criteria

• npm run test -- users passes at ≥75% coverage.
• A test proves password hashes never leave the service layer.
• Self-escalation through profile update is proven impossible.

Notes for Contributors

Comment below to be assigned.