fix(users): add manager to the valid-role whitelist

'manager' has been a fully-functional role throughout the app —
notifications, operator assignment, dispute mediation — but was
missing from both the user creation/update whitelist and the SSO
auto-provisioning role list, so a manager account could never
actually be created.

backend/tests/test_user_api_validation.py

@@ -57,3 +57,35 @@ def test_create_user_valid_password_accepted(client, admin_user, admin_token):
     )
     assert response.status_code == 201
     assert response.json()["username"] == "validuser99"
+
+
+def test_create_user_with_manager_role_accepted(client, admin_user, admin_token):
+    """Regression: 'manager' is a real, actively-used role (dispute mediation,
+    operator assignment) but was missing from the creation whitelist."""
+    response = client.post(
+        "/api/v1/users",
+        json={
+            "username": "newmanager",
+            "password": "ValidPass123!@#",
+            "email": "newmanager@test.com",
+            "role": "manager",
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert response.status_code == 201, response.text
+    assert response.json()["role"] == "manager"
+
+
+def test_create_user_invalid_role_rejected(client, admin_user, admin_token):
+    response = client.post(
+        "/api/v1/users",
+        json={
+            "username": "badroleuser",
+            "password": "ValidPass123!@#",
+            "email": "badrole@test.com",
+            "role": "superuser",
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert response.status_code == 400
+    assert "Invalid role" in response.text