fix(auth): refresh cached user after self-role edit so RoleSwitcher shows up

extra_roles changes made to the currently-logged-in admin's own account
weren't reflected until logout/login, since AuthContext only fetches
/users/me once at mount. Now refetches it when the edited user is the
caller themselves.

frontend/src/context/AuthContext.tsx

@@ -28,6 +28,10 @@ interface AuthState {
    * Reloads the page afterward so every role-gated component (nav, route
    * guards, etc.) re-evaluates cleanly against the new role. */
   switchRole: (role: string) => Promise<void>;
+  /** Re-fetch the current user from /users/me — call after an admin edits
+   * the logged-in user's own role/extra_roles so gated UI (e.g. the role
+   * switcher) picks it up without requiring a logout/login. */
+  refreshUser: () => Promise<void>;
 }
 
 const AuthContext = createContext<AuthState | undefined>(undefined);
@@ -93,6 +97,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
         login,
         logout,
         switchRole,
+        refreshUser,
       }}
     >
       {children}

frontend/src/pages/UsersPage.tsx

@@ -20,6 +20,7 @@ import {
   type UserCreatePayload,
 } from "../api/users";
 import { useToast } from "../components/Toast";
+import { useAuth } from "../context/AuthContext";
 
 const ROLES = [
   { value: "viewer", label: "Viewer" },
@@ -44,6 +45,7 @@ const roleBadgeColors: Record<string, string> = {
 export default function UsersPage() {
   const queryClient = useQueryClient();
   const { showToast } = useToast();
+  const { user: currentUser, refreshUser } = useAuth();
   const [showCreateModal, setShowCreateModal] = useState(false);
   const [editingUser, setEditingUser] = useState<UserOut | null>(null);
 
@@ -67,8 +69,12 @@ export default function UsersPage() {
   const updateMutation = useMutation({
     mutationFn: ({ userId, payload }: { userId: string; payload: Parameters<typeof updateUser>[1] }) =>
       updateUser(userId, payload),
-    onSuccess: () => {
+    onSuccess: (_data, { userId }) => {
       queryClient.invalidateQueries({ queryKey: ["users"] });
+      // Editing your own role/extra_roles wouldn't otherwise show up until
+      // a logout/login — refresh the cached auth user so gated UI (e.g.
+      // the role switcher) picks it up immediately.
+      if (userId === currentUser?.id) refreshUser();
       setEditingUser(null);
     },
   });