feat(identity+admin): CRM analytics + customer notes + user power-actions

Modeled on the legacy DivineGateWeb admin (CRM + Security/* actions):
- identity-svc AdminService + AdminController (admin-gated):
  - GET /v1/admin/crm/analytics — signups/buyers/conversion/revenue + daily series
    (from identity.users + identity.payments)
  - GET/PUT /v1/users/{id}/crm — tags / note / pipeline status (user_crm table, mig 20)
  - power-actions: POST /v1/users/{id}/{balance,password,charge,moderator,grant-plan}
- admin UI: /admin/crm dashboard (funnel cards + daily signup/revenue bars);
  per-user "مدیریت" modal in Users (balance, render charge, plan days, password,
  moderator, CRM notes)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/db/migrations/20_identity_user_crm.sql

@@ -0,0 +1,15 @@
+-- =====================================================================
+-- IDENTITY SCHEMA — Part 20: CRM notes/tags per customer
+-- Lightweight CRM overlay on identity.users (tags, free-form note, pipeline status).
+-- Acquisition/conversion analytics are computed live from users + payments.
+-- =====================================================================
+
+SET search_path TO identity, public;
+
+CREATE TABLE IF NOT EXISTS user_crm (
+    user_id    UUID PRIMARY KEY,
+    tags       TEXT[]      NOT NULL DEFAULT '{}',
+    note       TEXT,
+    status     TEXT        NOT NULL DEFAULT 'new',  -- new | contacted | customer | churned
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);