fix(auth): harden user update authorization

[perber]

No description provided.

[Copilot]

Pull request overview

This PR hardens the auth/user-management paths by preventing role escalation via user self-updates and by introducing a safeguard that blocks demoting the last remaining admin user.

Changes:

• Add RequesterIsAdmin to the UpdateUser use-case input and ignore role changes for non-admin requesters.
• Prevent demoting the last admin (core auth service + API error mapping + UI localization).
• Add focused tests covering role escalation prevention and last-admin demotion behavior.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
ui/leafwiki-ui/src/locales/en/errors.json	Adds localized UI copy for the “last admin cannot be demoted” error template.
internal/wiki/auth/use_cases.go	Adds requester context to UpdateUser and conditionally applies/validates role changes.
internal/wiki/auth/use_cases_test.go	Adds regression/behavior tests for UpdateUser role handling and last-admin constraints.
internal/wiki/auth/routes.go	Makes role optional in the update request payload and passes admin-ness to the use-case.
internal/wiki/auth/errors.go	Adds a new auth error code and maps the core error to an API response.
internal/core/auth/user_store.go	Adds a store helper to count admin users.
internal/core/auth/user_service.go	Blocks demoting the last admin user.
internal/core/auth/user_service_test.go	Adds tests for last-admin demotion blocking and demotion when another admin exists.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.