feat(phase-1): TapTrack Hub initial scaffold

Full project scaffold for TapTrack Hub — cloud SaaS control plane
for managing on-prem TapTrack school deployments.

## Infrastructure
- Docker Compose: backend (gunicorn+uvicorn), Celery worker + beat,
  frontend (Vite build + nginx), PostgreSQL 15, Redis 7, nginx proxy
- Dockerfile for backend and frontend, nginx reverse proxy config

## Backend (FastAPI + SQLAlchemy async + Celery)
Database schema (10 tables):
  hub_users, schools, licenses, sms_jobs, sms_credit_ledger,
  invoices, invoice_line_items, school_subscriptions,
  support_tickets, ticket_replies, audit_logs, announcements

Auth: JWT (python-jose) + bcrypt + role-based FastAPI dependencies
  (get_current_user, require_super_admin, require_school_admin)

Routers (11): auth, schools, licenses, sms, billing, tickets,
  users, dashboard, school_portal, announcements, sync

Celery tasks (6):
  sms.process_queue, billing.generate_monthly_invoices,
  billing.send_invoice_email, billing.check_overdue,
  license.check_expiry, reports.send_monthly_reports

Services: SMTP email helper (smtplib + Jinja2)
Seed script: creates super admin admin@taptrack.io

## Frontend (Vue 3 + Vite + Pinia + Tailwind CSS)
Router: 14 routes across super admin + school portal layouts
Stores: Pinia auth store with localStorage persistence
API client: full axios client for all backend endpoints
Layouts: AppLayout (super admin), PortalLayout (school), AuthLayout
Components: AppSidebar, PortalSidebar, SidebarItem, KpiCard,
  StatusBadge, ToastStack
Pages: Login, Dashboard, Schools, SchoolDetail, Licenses, SMS,
  Billing, Tickets, TicketDetail, Users, Announcements, 404
Portal pages: Overview, Billing, SMS Reports, Tickets, Profile

## PAUL Planning Files
- .paul/ROADMAP.md: full 15-phase roadmap with detailed scope
- .paul/STATE.md: current position, tech stack, architecture notes
- .paul/phases/01-setup/01-PLAN.md: complete Phase 1 plan (done)
- .paul/phases/02 through 15: README stubs for all future phases

backend/app/routers/users.py

@@ -0,0 +1,78 @@
+"""Hub user management — super admin only."""
+from typing import Optional
+from fastapi import APIRouter, Depends, HTTPException, Query
+from pydantic import BaseModel, EmailStr
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select, func, desc
+
+from app.auth.dependencies import require_super_admin
+from app.auth.password import hash_password
+from app.database import get_db
+from app.models.user import HubUser, UserRole
+
+router = APIRouter(prefix="/api/users", tags=["users"])
+
+class UserCreate(BaseModel):
+    email: EmailStr
+    full_name: str
+    password: str
+    role: UserRole = UserRole.school_admin
+    school_id: Optional[str] = None
+
+class UserUpdate(BaseModel):
+    full_name: Optional[str] = None
+    is_active: Optional[bool] = None
+    school_id: Optional[str] = None
+
+@router.get("")
+async def list_users(
+    page: int = Query(1, ge=1),
+    per_page: int = Query(25),
+    search: Optional[str] = Query(None),
+    _admin: HubUser = Depends(require_super_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    stmt = select(HubUser).order_by(desc(HubUser.created_at))
+    if search:
+        stmt = stmt.where(HubUser.email.ilike(f"%{search}%") | HubUser.full_name.ilike(f"%{search}%"))
+    total = (await db.execute(select(func.count()).select_from(stmt.subquery()))).scalar_one()
+    users = (await db.execute(stmt.offset((page - 1) * per_page).limit(per_page))).scalars().all()
+    return {
+        "items": [{"id": u.id, "email": u.email, "full_name": u.full_name, "role": u.role.value,
+                   "school_id": u.school_id, "is_active": u.is_active,
+                   "created_at": u.created_at.isoformat()} for u in users],
+        "total": total,
+    }
+
+@router.post("", status_code=201)
+async def create_user(
+    body: UserCreate,
+    _admin: HubUser = Depends(require_super_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    existing = (await db.execute(select(HubUser).where(HubUser.email == body.email))).scalar_one_or_none()
+    if existing:
+        raise HTTPException(409, "Email already exists")
+    if len(body.password) < 8:
+        raise HTTPException(422, "Password must be at least 8 characters")
+    user = HubUser(email=body.email, full_name=body.full_name,
+                   hashed_password=hash_password(body.password),
+                   role=body.role, school_id=body.school_id)
+    db.add(user)
+    await db.commit()
+    return {"id": user.id, "email": user.email, "full_name": user.full_name, "role": user.role.value}
+
+@router.put("/{user_id}")
+async def update_user(
+    user_id: str,
+    body: UserUpdate,
+    _admin: HubUser = Depends(require_super_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    user = (await db.execute(select(HubUser).where(HubUser.id == user_id))).scalar_one_or_none()
+    if not user:
+        raise HTTPException(404)
+    for field, value in body.model_dump(exclude_none=True).items():
+        setattr(user, field, value)
+    await db.commit()
+    return {"id": user.id, "email": user.email, "is_active": user.is_active}