feat: approval queue for domain managers

[martinydeAI]

Tracked under ADR 004 (#60).

Build the admin surface where a domainManager reviews and approves
or blocks pending accounts.

Scope

• Route /admin/users/pending listing users with status = Pending,
  restricted to users with domainManager = true (voter / IsGranted
  on the controller).
• Actions on each row:
  • Approve → status = Approved. User can now sign in.
  • Block → status = Blocked. User row preserved for audit.
• Same surface lets an approver flip an Approved user to Blocked
  and back (admin only).
• A thin service (App\Security\UserApproval or extension on
  App\Security\UserManager) owns the status transitions; the
  controller stays thin per project conventions.
• Twig templates re-use the existing layout / component primitives.
• Tests:
  • approver can approve a pending user; user can now log in
  • approver can block an approved user; user is rejected by the
    UserCheckerInterface from the sibling issue
  • non-approver (domainManager = false) is denied access (403)

Out of scope

• Bulk actions, filtering / search on the queue.
• Notifications (email the user when approved). Track separately if
  wanted.

Related

• ADR 004 (Decide on user registration, approval, and account-state model #60).
• User roles and permissions #12 — User roles and permissions (the domainManager flag we gate on).
• User profile and account management #13 — User profile and account management.
• feat: add User entity with active / domainManager / name fields #45 — User entity (must carry status + domainManager).

[martinyde]

A domain manager can only approve users under their own domain

[martinydeAI]

Update from the ADR 004 amendment: the gate on this queue is the
role ROLE_DOMAIN_MANAGER, not a domainManager boolean field. The
voter combines:

1. is_granted('ROLE_DOMAIN_MANAGER') on the acting user, and
2. emailDomain(currentUser) === emailDomain(targetUser)

ROLE_ADMIN sits above ROLE_DOMAIN_MANAGER in role_hierarchy,
and the voter short-circuits the domain-match check for admins so
the same queue/management screen scales to the site-admin use case
without a separate controller. Site admin sees everyone; a domain
manager sees only users whose email domain matches their own.

Scope updates implied by this:

• Drop references to domainManager = true in the issue body.
• The voter described above lands as part of this work (or split into
  a sibling under User roles and permissions #12 — see comment there).

See "Domain manager — a role, not a flag"
in ADR 004.