User access & quotas

Approve new signups, revoke access, override per-user review or citation caps. All actions hit the database directly via authenticated admin endpoints.