feat(auth) : add admin account management

db/schema.ts

@@ -34,8 +34,8 @@ const timestamps = {
     .notNull(),
 };
 
-// Better Auth core tables. Credential registration is restricted to
-// ADMIN_EMAIL, which is rechecked at every protected application boundary.
+// Better Auth core tables. Public registration is disabled; authenticated
+// administrators create additional credential accounts from the admin area.
 export const users = authSchema.table(
   "user",
   {
@@ -44,6 +44,10 @@ export const users = authSchema.table(
     email: text("email").notNull(),
     emailVerified: boolean("email_verified").default(false).notNull(),
     image: text("image"),
+    role: text("role").default("admin"),
+    banned: boolean("banned").default(false),
+    banReason: text("ban_reason"),
+    banExpires: timestamp("ban_expires", { withTimezone: true }),
     ...timestamps,
   },
   (table) => [uniqueIndex("user_email_unique").on(table.email)],
@@ -60,6 +64,7 @@ export const sessions = authSchema.table(
     userId: text("user_id")
       .notNull()
       .references(() => users.id, { onDelete: "cascade" }),
+    impersonatedBy: text("impersonated_by"),
     ...timestamps,
   },
   (table) => [