feat: open the last locked fields for editing, keeping their history intact

Four fields were still frozen because changing them would have bypassed the
record that makes the change traceable, and a user's login data could not be
corrected at all. Locking a field is the wrong trade: a wrong value stays in
the system forever. The fix is to let the edit write the same history entry the
dedicated endpoint writes.

- A colony's apiary is editable through PATCH and writes the same
  ColonyApiaryHistory entry POST /colonies/:id/move writes, so the location
  history never skips a stand the colony was recorded on.
- A honey batch's storage container is editable through PATCH and writes the
  same HoneyBatchRelocation entry POST /honey-batches/:id/relocate writes.
- A stock item's quantity is editable and books the difference as an ADJUSTMENT
  movement, so the stored level stays the sum of its movements.
- A role's key is editable (system roles were already rejected outright by
  RolesService.update, which keeps the seed's ADMIN lookup intact).
- A user's e-mail - the login identity - is editable. A typo there previously
  locked the account out for good.
- New POST /users/:id/reset-password lets an administrator set someone else's
  password: there is no self-service reset flow, so a forgotten password was
  the one thing no edit could repair. It revokes every refresh token and clears
  the permission cache exactly as a self-service change does, refuses to act on
  your own account (that goes through /profile/password, which proves ownership
  by asking for the current one), and never writes the password to the log.

Frontend:
- Users had no edit UI at all, although PATCH /users/:id existed. New
  EditUserDialog covers name, e-mail, role and an optional new password.
- Colony, honey batch and stock item forms gained the newly editable fields,
  each with a note saying the correction is recorded as a move, a relocation
  or a stock adjustment.
- The role dialog gained the key field.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/colonies/types.ts

@@ -47,6 +47,8 @@ export interface CreateColonyInput {
 }
 
 export interface UpdateColonyInput {
+  /** Correcting the apiary also writes a move-history entry server-side. */
+  apiaryId?: string;
   code?: string;
   hiveType?: string;
   originText?: string;

ApiCore-Frontend/src/lib/honey-batches/types.ts

@@ -95,6 +95,8 @@ export interface UpdateHoneyBatchInput {
   honeyType?: string;
   amount?: number;
   waterContent?: number;
+  /** Correcting the container also writes a relocation entry server-side. */
+  storageContainerId?: string;
   status?: HoneyBatchStatus;
 }
 

ApiCore-Frontend/src/lib/roles/types.ts

@@ -31,6 +31,7 @@ export interface CreateRoleInput {
 }
 
 export interface UpdateRoleInput {
+  key?: string;
   name?: string;
   description?: string;
   permissionKeys?: string[];

ApiCore-Frontend/src/lib/storage/types.ts

@@ -59,6 +59,8 @@ export interface CreateStockItemInput {
 
 export interface UpdateStockItemInput {
   name?: string;
+  /** Correcting the quantity books the difference as an ADJUSTMENT movement. */
+  quantity?: number;
   category?: StockCategory;
   unit?: string;
   minThreshold?: number;

ApiCore-Frontend/src/lib/users/api.ts

@@ -1,5 +1,5 @@
 import { apiFetch } from "@/lib/auth/api-client";
-import { CreateUserInput, User } from "./types";
+import { CreateUserInput, UpdateUserInput, User } from "./types";
 
 export function fetchUsers(): Promise<User[]> {
   return apiFetch<User[]>("/users");
@@ -12,6 +12,23 @@ export function createUser(input: CreateUserInput): Promise<User> {
   });
 }
 
+export function updateUser(id: string, input: UpdateUserInput): Promise<User> {
+  return apiFetch<User>(`/users/${id}`, {
+    method: "PATCH",
+    body: JSON.stringify(input),
+  });
+}
+
+export function resetUserPassword(
+  id: string,
+  password: string,
+): Promise<User> {
+  return apiFetch<User>(`/users/${id}/reset-password`, {
+    method: "POST",
+    body: JSON.stringify({ password }),
+  });
+}
+
 export function deactivateUser(id: string): Promise<User> {
   return apiFetch<User>(`/users/${id}/deactivate`, { method: "POST" });
 }

ApiCore-Frontend/src/lib/users/types.ts

@@ -20,5 +20,6 @@ export interface CreateUserInput {
 
 export interface UpdateUserInput {
   name?: string;
+  email?: string;
   roleId?: string;
 }