implement user search and admin promote endpoints

GET /users?q=... is public; POST /admin/users/promote is auth
required and admin-checked inside the use case.

backend/routes/api.php

@@ -3,6 +3,7 @@
 use App\Controllers\AuthController;
 use App\Controllers\CommentController;
 use App\Controllers\PostController;
+use App\Controllers\UserController;
 use App\Http\Middleware\AuthMiddleware;
 use Illuminate\Support\Facades\Route;
 
@@ -32,6 +33,10 @@ Route::post('/admin/posts/feature', [PostController::class, 'feature'])
 Route::post('/admin/posts/unfeature', [PostController::class, 'unfeature'])
     ->middleware(AuthMiddleware::class);
 
+Route::get('/users', [UserController::class, 'search']);
+Route::post('/admin/users/promote', [UserController::class, 'promote'])
+    ->middleware(AuthMiddleware::class);
+
 Route::get(
     '/users/{displayName}/posts',
     [PostController::class, 'listByUser'],