GET /users?q=... is public; POST /admin/users/promote is auth required and admin-checked inside the use case.
