feat: add delete user and change password functioality

docs/api.md

@@ -24,11 +24,16 @@ Swagger UI: `http://localhost:3001/api/docs`
 `POST /auth/login` - Login with email/password
 `POST /auth/refresh` - Refresh access token
 `POST /auth/logout` - Logout and revoke refresh token
+`POST /auth/change-password` - Change the signed-in user's password `{ currentPassword, newPassword }`. Revokes all
+  their refresh tokens and returns new tokens, like a login. `400 wrong_password` when the current one is wrong.
 
 ### Venues
 `GET /venues` - List venues
 `GET /venues/:venueId` - Get venue details
 `GET /venues/:venueId/devices` - The venue's paired terminals `{ devices: [...] }`
+`GET /venues/:venueId/users` - List dashboard users (admin)
+`POST /venues/:venueId/users` - Create a user (admin)
+`DELETE /venues/:venueId/users/:userId` - Delete a user and revoke their refresh tokens (admin; not yourself)
 
 ### Devices
 `POST /devices/register` - Pair a terminal; every pairing adds one
@@ -84,6 +89,8 @@ and `docs/server-stock-source-of-truth.md`.
 
 ### Tabs
 `GET /venues/:venueId/tabs` - List open tabs
+`DELETE /venues/:venueId/tabs/:tabId?expectedVersion=` - Delete a tab without settling it, like `tab_deleted` on a
+  terminal (admins and managers). `409 version_mismatch` when it changed since `expectedVersion`.
 
 ### Planned Tabs (customer list)
 `GET /venues/:venueId/planned-tabs` - List planned customers