fix(users): admin can never strip their own admin permission

Both backend (PATCH /users/{id}) and frontend (Edit User modal) now block
an admin from changing their own primary role away from admin or removing
admin from their own extra_roles, closing off a self-lockout scenario.

backend/tests/test_multi_role_switch.py

@@ -4,6 +4,42 @@ instead of ever mixing permissions from more than one.
 """
 
 
+def test_admin_cannot_remove_own_admin_role(api, auth_headers, admin_user):
+    resp = api(
+        "patch", f"/api/v1/users/{admin_user.id}", auth_headers,
+        json={"role": "viewer"},
+    )
+    assert resp.status_code == 400
+    assert "admin" in resp.text.lower()
+
+
+def test_admin_cannot_drop_admin_via_extra_roles_either(api, auth_headers, admin_user):
+    # Give themselves a second role first, then try to swap the primary
+    # role away from admin without admin anywhere in extra_roles.
+    resp = api(
+        "patch", f"/api/v1/users/{admin_user.id}", auth_headers,
+        json={"role": "red_lead", "extra_roles": ["viewer"]},
+    )
+    assert resp.status_code == 400
+
+
+def test_admin_can_switch_primary_role_if_admin_kept_in_extra_roles(api, auth_headers, admin_user):
+    resp = api(
+        "patch", f"/api/v1/users/{admin_user.id}", auth_headers,
+        json={"role": "red_lead", "extra_roles": ["admin"]},
+    )
+    assert resp.status_code == 200, resp.text
+
+
+def test_admin_can_edit_own_other_fields_without_touching_role(api, auth_headers, admin_user):
+    resp = api(
+        "patch", f"/api/v1/users/{admin_user.id}", auth_headers,
+        json={"full_name": "Renamed Admin"},
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["role"] == "admin"
+
+
 def test_admin_can_grant_extra_roles(api, auth_headers):
     created = api(
         "post", "/api/v1/users", auth_headers,