Multi-user: email sign-in, invite/open registration, admin calls

- kv-proto: email on setup, AccountInfo.email/is_admin, ServerInfo.registration, admin DTOs.
- kv-sync: prelogin by email or account id (setup QR / Emergency Kit), register with email,
  set_email, /v1/admin/* client calls.
- kv-ffi: register_account(code, email), login(.., email), account_details, set_account_email,
  admin_create_invite. kv-wasm: the same plus the full admin API for the web vault.
- Live test: two users on one server stay isolated; a new device signs in by email.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-wasm/src/dto.rs

@@ -88,6 +88,56 @@ pub struct ServerInfoDto {
     pub api: u32,
     pub setup_open: bool,
     pub min_client: String,
+    /// "invite" or "open" (absent on servers from before multi-user).
+    pub registration: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountDetailsDto {
+    pub email: Option<String>,
+    pub is_admin: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminUserDto {
+    pub account_id: String,
+    pub email: Option<String>,
+    pub is_admin: bool,
+    pub disabled: bool,
+    pub created_at: String,
+    pub last_seen: Option<i64>,
+    pub devices: u32,
+    pub items: u32,
+    pub storage_bytes: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct InviteDto {
+    pub invite_id: String,
+    pub email: Option<String>,
+    pub created_at: i64,
+    pub expires_at: i64,
+    pub used: bool,
+    pub revoked: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct InviteCreatedDto {
+    pub invite_id: String,
+    pub code: String,
+    pub expires_at: i64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminSettingsDto {
+    /// "invite" or "open".
+    pub registration: String,
+    pub allowed_domains: Vec<String>,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]