fix(admin): refuse to remove or demote the last admin #433

Why

Nothing stops the last admin being deleted, losing the admin role, or deleting their own account (admin user delete and role update in src/controllers/admin.ts, and DELETE /users/me). The only way back is a direct database edit, since OWNER_EMAIL grants admin only when the account is created.

What

• Refuse, with a clear error, any delete or role change that would leave no user holding admin:write
• Same check on self-delete
• Audit the refusal
• Worked together with fix: refuse to delete a user's last sign-in method #400 (last sign-in method)

Done when

No API call can leave a deployment without an admin.