feat(identity+admin): CRM analytics + customer notes + user power-actions

Modeled on the legacy DivineGateWeb admin (CRM + Security/* actions):
- identity-svc AdminService + AdminController (admin-gated):
  - GET /v1/admin/crm/analytics — signups/buyers/conversion/revenue + daily series
    (from identity.users + identity.payments)
  - GET/PUT /v1/users/{id}/crm — tags / note / pipeline status (user_crm table, mig 20)
  - power-actions: POST /v1/users/{id}/{balance,password,charge,moderator,grant-plan}
- admin UI: /admin/crm dashboard (funnel cards + daily signup/revenue bars);
  per-user "مدیریت" modal in Users (balance, render charge, plan days, password,
  moderator, CRM notes)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/identity/FlatRender.IdentitySvc/Models/Admin.cs

@@ -0,0 +1,29 @@
+namespace FlatRender.IdentitySvc.Models;
+
+// ── CRM analytics (acquisition / conversion funnel) ──────────────────────────
+
+public record CrmDailyPoint(string Date, int Signups, int Buyers, long RevenueMinor);
+
+public record CrmAnalyticsResponse(
+    int TotalSignups,
+    int Buyers,
+    int NonBuyers,
+    double ConversionRate,
+    long RevenueMinor,
+    int PayingUsersAllTime,
+    List<CrmDailyPoint> Daily
+);
+
+// ── CRM notes / tags per customer ────────────────────────────────────────────
+
+public record UserCrmResponse(string[] Tags, string? Note, string Status);
+
+public record UpsertUserCrmRequest(string[]? Tags, string? Note, string? Status);
+
+// ── User admin power-actions ─────────────────────────────────────────────────
+
+public record SetBalanceRequest(long AmountMinor, bool Add);          // Add=false → set absolute
+public record ResetPasswordRequest(string NewPassword);
+public record AddChargeRequest(int Seconds, int RenderCount);         // grant render seconds / daily renders
+public record GrantPlanDaysRequest(Guid PlanId, int Days);
+public record SetFlagRequest(bool Enabled);