Add CWMS user role management panel

[krowvin]

Summary

Add a Users landing page and office-scoped role management. Administrators can find a registered user outside their office, assign that user to an office they administer, and then configure the user's roles.

• Add Assign office beside the office selector. Search usernames across offices and show each matching user's existing office roles.

• Assign the required All Users role in the destination office, preserve other office assignments, prevent duplicates, and select the user in the role editor after saving.

• Provide read-only, read/write, and user-administrator presets plus custom roles, database role descriptions, search, pagination, and user counts.

• Filter office cards by the roles returned for that office, including users with only All Users, and keep long identifiers within the role panel.

• Use the shared Groundwork Water user hooks, role presets, descriptions, and authorization-limited office selector.

Related to #1917. Recommended onboarding is: staff sign in to CDA once, then the destination-office administrator assigns the office and selects roles. This UI does not create identity-provider accounts or automatically grant elevated access.

Dependency gate

Depends on USACE-WaterManagement/groundwork-water#329, including cross-office user search in c372f03.

Do not merge until that change is released and this branch consumes the released package version. Local GUI validation used the package built from the dependency PR; the registry dependency has not yet been updated.

Role description source

CDA currently returns role names without definitions. The shared temporary description map comes from cwms-database/schema/src/cwms/at_schema_sec.sql (cwms_sec_user_groups.user_group_desc), including SHOW STACK TRACE. It can be replaced when CDA supplies the descriptions.

Validation

• CDA GUI: 9 tests passed; lint and production build passed.

• Groundwork Water user hooks: 8 tests passed; library build passed.

• Built and ran this branch's backend WAR with local Oracle and Keycloak. Browser testing used real local API responses and direct login, without browser request interception.

• Verified new-user registration with HQ All Users, cross-office search, SWT membership assignment by an SWT administrator with no HQ admin rights, automatic selection in the editor, read/write role saves, preservation of HQ membership, duplicate prevention, and no-match onboarding guidance.

• Verified the assignment dialog at desktop and 390x844 mobile sizes; no JavaScript page errors. The existing page shell retains a small mobile overflow separate from the dialog.

• Backend source is unchanged; the full Java integration suite was not run. Earlier UI validation also covered 75 mock users per office for pagination and role configurations.

Existing API findings

The local tests reproduced two issues outside this UI change: an office-filtered user query can return users without membership in that office, and an unauthorized office grant returns 500 rather than a permission error. The UI filters returned memberships and limits destination choices, while server authorization remains authoritative. The user-list endpoint also returns the principal in its email field on this branch; the individual-user endpoint returns the correct email.

Screenshots

Captured against the local PR backend with real Oracle and Keycloak.

Find a user and assign another office

Save roles within the assigned office

Review office memberships and prevent duplicate assignment

Mobile office assignment

Guidance for users who have not signed in yet