feat: add scoped upload tokens

nextjs/app/manage/admin/users/page.js

@@ -9,6 +9,7 @@ import { all, runCleanupIfNeeded } from '@/src/lib/db.js';
 import { formatTimestamp, readSearchParam } from '@/src/lib/format.js';
 import { ensureCsrfToken, requireAdminUser } from '@/src/lib/security.js';
 
+import { AdminTabs } from '../../_components/admin-tabs.js';
 import { StatusMessage } from '../../_components/status-message.js';
 
 export const dynamic = 'force-dynamic';
@@ -34,20 +35,16 @@ export default async function AdminUsersPage({ searchParams }) {
           <p className="muted">Konten erstellen, Passwort setzen oder Benutzer entfernen.</p>
         </div>
 
-        <div className="toolbar">
-          <a className="chip" href="/manage/admin/dashboard">
-            Zur Adminübersicht
-          </a>
-          <form className="inline-form" action={adminLogoutAction}>
-            <input type="hidden" name="csrfToken" value={csrfToken} />
-            <button className="btn secondary" type="submit">
-              Abmelden
-            </button>
-          </form>
-        </div>
+        <form className="inline-form" action={adminLogoutAction}>
+          <input type="hidden" name="csrfToken" value={csrfToken} />
+          <button className="btn secondary" type="submit">
+            Abmelden
+          </button>
+        </form>
       </header>
 
       <StatusMessage error={error} success={success} />
+      <AdminTabs active="users" />
 
       <nav className="tabs" aria-label="Benutzer-Bereiche">
         <a className={`tab ${activeTab === 'users' ? 'active' : ''}`} href="/manage/admin/users?tab=users">