fix(admin): correct identity register & change-password routes (405)

[iammukeshm]

Problem

Adding a user from the admin app failed with 405 Method Not Allowed on POST /api/v1/identity/users/register (issue #1309).

The admin client posted to:

• /api/v1/identity/users/register
• /api/v1/identity/users/change-password

…but the API serves these as bare routes:

• /api/v1/identity/register
• /api/v1/identity/change-password

The /users prefix is only for user-collection sub-resources (/users, /users/{id}, /users/{id}/roles, …). register and change-password live directly under the identity group.

Why only admin was affected

• The dashboard app already calls the correct bare routes (clients/dashboard/src/api/identity.ts).
• The identity integration tests exercise /identity/register and /identity/change-password.
• Only clients/admin/src/api/users.ts was wrong — and internally inconsistent: it already used the IDENTITY base (no /users) for forgot-password, reset-password, profile, and permissions, but used the /users BASE for these two calls.

Fix

Point registerUser and changePassword at the IDENTITY base, and update the route-mocked Playwright specs to match the real routes.

Verification

• tsc -b clean.
• All 13 admin user/security Playwright specs pass against a clean dev server (register POST, change-password POST, validation, error paths).

Fixes #1309

🤖 Generated with Claude Code