Users & access

The app's own users live here, the same rows the auth table holds. list returns them with their roles and a masked view of any API key. set-role replaces a user's role set, so an access change takes effect immediately against the RBAC the backend already enforces. There is no separate identity store to reconcile: this is the live account list.

The other two commands run the API-key lifecycle for programmatic access. create-api-key mints a key for a user and returns the full value exactly once. Only its masked form is kept afterward, and it requires the app's live release to have the api-key auth method enabled. revoke-api-key invalidates a key immediately, cutting off a leaked key mid-flight instead of waiting for the next rotation.