feat(users): OpenAPI docs, input sanitization, search refactor, retry with backoff

[Essther77-git]

• Document UserAPI with OpenAPI specs #1355: @ApiOperation/@apiresponse on the main UsersController operations; docs/api/users-openapi.md
• Add input sanitization to UserAPI #1356: class-transformer sanitisation of email, name and search fields in CreateUserDto/UpdateUserDto/SearchUsersDto (NFKC, control chars, HTML tags; email case and passwords untouched); docs/api/users-input-sanitization.md
• Refactor UserAPI to reduce complexity #1357: UsersService.search filter construction extracted into buildSearchWhere; behaviour unchanged; docs/api/users-refactor.md
• Add retry with backoff to UserAPI #1358: retryWithBackoff util applied to the email-change verification emails; docs/api/users-retry.md

Scope kept minimal: small module-local additions plus a short doc under docs/api/ per issue. Each issue's tests are not added unless the issue is itself about tests; nothing was run. The refactor is behaviour-preserving but unverified (not compiled or tested). Other User API PRs in this batch also edit users.controller.ts, users.service.ts and dto/user.dto.ts, so expect trivial merge conflicts.

Nothing was installed, built or run (no tsc, lint or jest); please verify in CI/review.

Closes #1355
Closes #1356
Closes #1357
Closes #1358

[drips-wave]

@Essther77-git Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[nanaf6203-bit]

LGTM